Processual SEMOMAP : an Application and Evaluation of the Accident Investigation Model in Passenger Ship Accidents Yogender Singh World Maritime University

World Maritime University The Maritime Commons: Digital Repository of the World Maritime University

World Maritime University Dissertations Dissertations

2014 Processual SEMOMAP : an application and evaluation of the accident investigation model in passenger ship accidents Yogender Singh World Maritime University

Follow this and additional works at: http://commons.wmu.se/all_dissertations Part of the Emergency and Disaster Management Commons

Recommended Citation Singh, Yogender, "Processual SEMOMAP : an application and evaluation of the accident investigation model in passenger ship accidents" (2014). World Maritime University Dissertations. 477. http://commons.wmu.se/all_dissertations/477

This Dissertation is brought to you courtesy of Maritime Commons. Open Access items may be downloaded for non-commercial, fair use academic purposes. No items may be hosted on another server or web site without express written permission from the World Maritime University. For more information, please contact [email protected]. WORLD MARITIME UNIVERSITY Malmö, Sweden

PROCESSUAL SEMOMAP: An application and evaluation of the accident investigation model in passenger ship accidents

YOGENDER SINGH India

A dissertation submitted to the World Maritime University in partial fulfilment of the requirements for the award of the degree of

MASTER OF SCIENCE In MARITIME AFFAIRS

(MARITIME SAFETY AND ENVIRONMENTAL ADMINISTRATION)

2014

DECLARATION

I certify that all the material in this dissertation that is not my own work has been identifies, and that no material is included for which a degree has previously been conferred on me.

The contents of this dissertation reflect my own personal views, and are not necessarily endorsed by the University.

(Signature): …………………………………

(Date): .……………………………..….

Supervised by: Dr. Jens-Uwe Schröder-Hinrichs World Maritime University

Assessor: Institution/organisation:

Co-assessor: Institution/organisation:

ACKNOWLEDGEMENTS

At the very outset, I would like to thank my supervisor Dr. Jens-Uwe Schröder- Hinrichs for his guidance and support that enabled me to successfully undertake my dissertation. I am grateful for his mentoring and encouragement that helped me to accomplish my research project. His vision, time and effort in supervising me are highly appreciated.

I am also grateful to Raza Mehdi of the MaRiSa research group in particular, for his support at each stage of the project. He ensured that I had the necessary input and tools to keep the project moving ahead.

I would like to thank the faculty at the World Maritime University who contributed to my learning and development over the course of the year.

I am thankful to the staff of the World Maritime University, particularly the library staff for their support in procuring literature for my dissertation.

I am thankful to the World Maritime University for the facilities made available to me that made it possible for me to complete my dissertation.

Several individuals have contributed to the success of this dissertation. I wholeheartedly thank them all and acknowledge that I alone and responsible for any shortcomings of the dissertation.

Last but not the least, I would like to thank my family for their support and encouragement.

iii

ABSTRACT

Title of Dissertation: Processual SEMOMAP: An application and evaluation of the accident investigation model in passenger ship accidents

Degree: MSc

This dissertation is an exploratory application and evaluation of the SEquential MOdel of the Maritime Accident Process (SEMOMAP) accident investigation model. SEMOMAP is uniquely positioned in the academic literature by virtue of its focus on the accident process. The dissertation aims to reveal insights into why some unfolding processes help the system to achieve a safe operative state, while others lead to a mitigated or total loss.

Fifteen publicly available accident investigation reports from Maritime Administrations and investigating bodies are analysed utilising the SEMOMAP. The accident investigation reports are coded with the help of two taxonomies – Human Factors Analysis and Classification Systems (HFACS) and a taxonomy inspired by the Technique for the Retrospective and Predictive Analysis of Cognitive Errors (TRACEr). These taxonomies complement the SEMOMAP and provide a comprehensive perspective to accident investigation.

The fifteen reports selected for analysis are of passenger vessel accidents that have taken place after the introduction of the International Safety Management (ISM) code in 1998 presuming the existence of a functional Safety Management System (SMS) ashore and on-board to ensure compliance with the code, including compliance with the Standards of Training, Certification and Watch Keeping (STCW).

The accident reports are examined and the analysis helps to evaluate the SEMOMAP model and its performance. The analysis subjects the model to rigorous analytic evaluation. The purpose of the dissertation is twofold – on the one hand are the results of the analysis obtained after applying the model and on the other is the evaluation of the model itself, highlighting its strengths, weaknesses and unique contribution.

The results are collated and discussed in the penultimate chapter (number 5); conclusions are drawn and recommendations are made in the final chapter 6. The dissertation argues that SEMOMAP with its complementary HFACS and TRACEr inspired taxonomies contributes to an enhanced and comprehensive understanding of the accident processes. The insights from applying the model make a valuable input for system resilience.

KEYWORDS: SEMOMAP, Accident investigation models, HFACS, TRACEr, IMO casualty investigation

TABLE OF CONTENTS

Declaration……………………………………………………………………ii

Acknowledgements…………………………………………………………..iii

Abstract………………………………………………………………………iv

Table of Contents…………………………………………………………..v-vi

List of Tables………………………………………………………….……..vii

List of Figures……………………………………………………………....viii

List of Abbreviations…………………………………………………………ix

1 Introduction…………………………………………………………1-9 1.1 Background……………………………………………………..1-7 1.2 Aim, purpose and motivation for the dissertation……………....7-8 1.3 Structure of the dissertation……………………………………..8-9

2 Accident Causation Models – a Literature Review………………10-19 2.1 Sequential, epidemiological and systemic models…………...11-15 2.2 Evaluation of sequential, epidemiological and systemic models: advantages and disadvantages ………………………………..16-17 2.3 Maritime specific models……………………………………….17 2.4 Taxonomy for coding data……………………………………...18 2.5 Conclusion…………………………………………………..18-19

3 Research Methodology…………………………………………...20-35

3.1 Research methodology and sample selection………………….20-21 3.2 SEMOMAP……………………………………………………21-26 3.3 SEMOMAP taxonomy………………………………………...26-34 3.4 Conclusions……………………………………………………….35

4 Analysis of Accident Investigation Reports……………………...... 36-83 4.1 SEMOMAP solved case study example……………………....36-44 4.2 Dissertation results…………………………………………….45-73 4.3 Overview of the results of all 3 categories – flooding, grounding and fire……………………………………………..74-83 4.4 Summary.………………………………………………………....83

5 Reflection on Results……………………………………………..84-90 5.1 Reflection on SEMOMAP…………………………………....84-85 5.2 Reflection on Results and Research Questions………………86-90 5.3 Summary……………………………………………………...... 90

6 Conclusions………………………………………………………91-92

7 Appendices………………………………………………………93-153 Appendix 1 Detail list of accident investigation reports……93-100 Appendix 2 SEMOMAP code book……………………….101-153 8 References……………………………………………………...154-157

LIST OF TABLES Table 1: Subjects affected by influencing factors (applicable to phase 0)………………26 Table 2: SEMOMAP Taxonomy phase 0; factors leading to the dangerous situation; adapted HFACS……………………………………………………...27 Table 3: ‘Risk of’ incident; taxonomy table 1.1 Applicable to phase 1……………….. .28 Table 4: Breakdown of accident investigation reports analyzed………………………..36 Table 5: Monarch of the Seas ‘phase 0’ HFACS………………….……………..……...38 Table 6: Monarch of the Seas ‘phase 1’ coding (SEMOMAP taxonomy table 1.1)….…39 Table 7: Monarch of the Seas ‘phase 1’ coding (SEMOMAP taxonomy table 1.2, 1.3)..39 Table 8: Monarch of the Seas ‘phase 2’ coding (SEMOMAP taxonomy table 2.1)….…40 Table 9: Monarch of the Seas ‘phase 2’ coding (SEMOMAP taxonomy table 2.2, 2.3)..41 Table 10: Monarch of the Seas ‘phase 3’ coding (SEMOMAP taxonomy table 3.2, 3.3)……...... 42-43 Table 11: List of accident investigation reports analyzed……………………………….45 Table 12: List of accident investigation reports analyzed……………………………….46 Table 13: Flooding accident category ‘phase 0’ HFACS overview ……………..……...47 Table 14: Flooding accident category ‘phase 1’ overview (level L2B)…….…………...49 Table 15: Grounding accident category ‘phase 0’ HFACS operator overview……..…...51 Table 16: Grounding accident category ‘phase 0’ HFACS equipment overview…..…...52 Table 17: Fire accident category ‘phase 0’ HFACS operator overview…………...... 64-65 Table 18: Fire accident category ‘phase 0’ HFACS equipment overview……..………..66 Table 19: All accident categories ‘phase 0’ (HFACS) overview………………….....74-75 Table 20: All accident categories ‘phase 0’ (HFACS) equipment overview………...77-78 Table 21: All accident categories, all phases, level 3-4 and 4-5 evaluation………….79-80 Table 22: All accident categories, all phases, level 3-4 and 4-5 summary………………81 Table 23: Timelines: all accident categories across all phases………………………...... 82

LIST OF FIGURES Figure 1: Total losses by vessel type 2002-2013…………………………………………2 Figure 2: Total losses by vessel type from 1 Jan – 31 Dec 2013…………………………3 Figure 3: Causes of total losses from 1 Jan – 31 Dec 2013…………………………..…..3 Figure 4: Heinrich’s Domino Model of Accident Causation………………………..…..12 Figure 5: Swiss Cheese Model…………………………………………………………..13 Figure 6: Risk Management Framework………………………………………………...15 Figure 7: Interaction / coupling chart…………………………………………………....15 Figure 8: SEMOMAP in 2004…………………………………………………………..22 Figure 9: SEMOMAP in 2014…………………………………………………………..23 Figure 10: Relationship between Table 1 and 2 of taxonomy applicable to ‘phase 0’.....28 Figure 11: Diagrammatic representation of taxonomy table 1.2 applicable to ‘phase 1’.29 Figure 12: Diagrammatic representation of taxonomy table 1.3 applicable to ‘phase 1’.30 Figure 13: Diagrammatic representation of taxonomy table 2.2 applicable to ‘phase 2’.31 Figure 14: Diagrammatic representation of taxonomy table 2.3 applicable to ‘phase 2’.32

vii

Figure 15: Diagrammatic representation of taxonomy table 3.2 applicable to ‘phase 3’.33 Figure 16: Diagrammatic representation of taxonomy table 3.3 applicable to ‘phase 3’.33 Figure 17: SMoC – Simple Model of Cognition………………………………………..34 Figure 18: Wickens’ Model of Human Information Processing………………………..34 Figure 19: FTA Monarch of the Seas…………………………………………………...44 Figure 20: Flooding ‘phase 0’ operator overview...…………………………………….48 Figure 21: Flooding ‘phase 1’ overview (L3-4)………………………………………...49 Figure 22: Grounding ‘phase 0’ operator overview………………………………….....53 Figure 23: Grounding ‘phase 0’ equipment overview…………………………………..53 Figure 24: Grounding ‘phase 1’ overview (L1-2)………………………………………54 Figure 25: Grounding ‘phase 1’ overview (L3-4)………………………………………55 Figure 26: Grounding ‘phase 1’ overview (L4-5)………………………………………56 Figure 27: Grounding ‘phase 2’ overview (L1-2)………………………………………57 Figure 28: Grounding ‘phase 2’ overview (L3-4)………………………………………58 Figure 29: Grounding ‘phase 2’ overview (L4-5)………………………………………59 Figure 30: Grounding ‘phase 3’ overview (L1-2)……………………………………....60 Figure 31: Grounding ‘phase 3’ overview (L3-4)………………………………………61 Figure 32: Fire ‘phase 0’ HFACS operator overview…………………………………..62 Figure 33: Fire ‘phase 0’ HFACS equipment overview………………………………..63 Figure 34: Fire ‘phase 1’ overview (L1-2)………..………………………………...67 Figure 35: Fire ‘phase 1’ overview (L3-4) .………………………………………….....68 Figure 36: Fire ‘phase 1’ overview (L4-5) .………………………………………….....69 Figure 37: Fire ‘phase 2’ overview (L1-2) .………………………………………….....70 Figure 38: Fire ‘phase 2’ overview (L3-4) .………………………………………….....71 Figure 39: Fire ‘phase 2’ overview (L4-5) .………………………………………….....72 Figure 40: All accident categories ‘phase 0’ HFACS category overview……………....76

viii

LIST OF ABBREVIATIONS

BRM Bridge Resource Management BTM Bridge Team Management BSU Bundesstelle für Seeunfalluntersuchung CREAM Cognitive Reliability and Error Analysis Method CSM Continuous Survey of Machinery DNV Det Norske Veritas DoD Department of Defence, the United States of America ETTO Efficiency Thoroughness Trade Off FSA Formal Safety Assessment GEMS Generic Error-Modelling System HEART Human Error Assessment and Reduction Technique HFACS Human Factors Analysis and Classification Systems IMO International Maritime Organisation ISM International Safety Management MaRiSa Maritime Risk and System Safety MSC Maritime Safety Committee SEMOMAP SEquential MOdel of the Maritime Accident Process SMS Safety Management System SOLAS Safety of Life at Sea Convention, 1974, as amended STCW Standards of Training, Certification and Watch Keeping Convention, 1978, as amended TRACEr Technique for the Retrospective and Predictive Analysis of Cognitive Errors THERP Technique for Human Error Rate Prediction USCG United States Coast Guard WMU World Maritime University WYLFIWYF What-You-Look-For-Is-What-You-Find

1. INTRODUCTION

This dissertation analyses passenger ship accident investigation reports with the SEMOMAP model and HFACS and TRACEr inspired taxonomies to explore accident processes that enable a system to achieve a safe system state and those that lead to a mitigated, severe or total loss. The opening chapter provides the background and motivation for the dissertation along with its aim and purpose. The chapter introduces the research problem under investigation and provides an outline structure of the dissertation.

1.1 BACKGROUND State-of-the-art passenger ships appear like floating residential towers and represent a marvel of scientific advances in technology (for ship fire safety design see, Cooke, 2007). Despite that, even in the 21st-century, we are not immune to serious maritime accidents that have devastating consequences for life, property and the environment. The tragic sinking of the Costa Concordia in the beginning of 2012, a 100 years after the Titanic disaster (see Schröder-Hinrichs et al., 2012) highlights that even in the modern era of advanced technology, (allegedly) safer systems and international regulations, severe maritime accidents continue to occur. Even before the wreck of the Costa Concordia entered the final phase of its salvage operations in July 2014, another accident of a passenger ferry in April 2014 - Sewol captured international headlines with over 300 fatalities. Even though Sewol was a domestic ferry and not an international passenger ship, the accident and the loss of lives is disconcerting.

Passenger ship accidents, that resulted in a total loss (99 ships) account for nearly 6% of all accidents from 2002 to 2013 (AGCS, 2014, p. 8) and this figure increases to

6.38% for 2013 (AGCS, 2014, p. 9). Figure 1 below, depicts the total losses by ship type for the years covering 2002-2013 and Figure 2 depicts the total losses by ship type for 2013. The biggest cause of the total loss was identified as foundering, accounting for 44.5% for the period ranging from 2002-2012 (AGCS, 2014, p. 10). The percentage for foundering increased to 73.4% for all total losses in 2013 (AGCS, 2014, p. 11) (see figure 3).

Figure 1: Total losses by vessel type 2002-2013

Source: Allianz Global Corporate & Specialty (2014, p. 8)

Figure 2: Total losses by vessel type from 1 Jan – 31 Dec 2013

Source: Allianz Global Corporate & Specialty (2014, p. 9)

Figure 3: Causes of total losses from 1 Jan – 31 Dec 2013

Source: Allianz Global Corporate & Specialty (2014, p. 11)

Passenger ship accidents and accompanying devastating consequences, particularly for human life, capture the public imagination and provide impetus to the International Maritime Organisation (IMO) as a specialised agency of the United Nations (UN) to regulate maritime safety and related issues with the aim of preventing accidents from recurring in the future. The 1914 version of the Safety of Life At Sea Convention

(SOLAS) (IMO, 1974, as amended) was the first version of the convention and a direct response to the Titanic disaster in 1912 which had resulted in over 1500 fatalities. The prominent accident of the Herald of Free Enterprise in 1987 with a loss of 193 lives resulted in the introduction of the ISM code (IMO, 2002). While these come across as essentially reactive IMO actions to serious accidents (Tarelko, 2012), the organisation has done significant work in Passenger Ship Safety from 2000 onwards since the launch of the initiative. The following sub-section (1.1.1) discusses the work of the IMO in relation to passenger ship safety.

1.1.1 IMO and PASSENGER SHIP SAFETY The initiative on passenger ship safety was launched in Dec 2000 in MSC 72, at the turn of the century to evaluate the adequacy of rules and regulations with respect to large passenger ships as they had been framed before the construction of such ships. The size of the vessels, along with increase in passenger carrying capacity necessitated this initiative especially with respect to crew training and emergency situations. Aspects of the ship, people on board and the environment were to be taken into consideration by the respective subcommittees. It was agreed that future ship design should cater to improved survivability as “a ship is its best lifeboat” (IMO, 2000a). Initially the initiative aimed to address safety of large passenger ships in particular. However, subsequently it was considered beneficial for the safety of all passenger ships and accordingly re-titled.

Five pillars have guided the work of the committee in this initiative which are prevention, improved survivability, regulatory flexibility, operations in areas remote from SAR facilities and health safety and medical care. A host of amendments were adopted in MSC 82 in 2006 that included amendments on alternate design, safe areas, safety centres, fire prevention, detection and alarm systems and evacuation and abandonment post breach of threshold (IMO, 2006, also see IMO, 2010b).

Previously regulations stated that passenger safety drills should take place within 24 hours of departure. However, more recently MSC 91 in 2012 agreed to make passenger safety drills prior to, or immediately upon departure, mandatory (IMO, 2012). The same has been adopted into SOLAS regulation III/19 (IMO, 2013b, IMO, 1974, as amended) and are due to enter into force on 1 January 2015. In addition, MSC 92 revised the recommended interim measures for passenger ship companies to enhance the safety of passenger ships. Among others, the recommendations include suggestions on lifejackets (placement and availability), emergency instructions to passengers, musters, securing heavy objects etc. (IMO, 2013c, also see IMO, 1997c).

Despite safety initiatives, passenger ship accidents have continued to take place over the years. In the aftermath of an accident, the investigation process commences, and attempts to examine the accident in-depth and study its varied aspects, including the causes. Learning from accidents is invaluable and the role of the IMO in casualty investigation follows in sub-section 1.1.2.

1.1.2 IMO and CASUALTY INVESTIGATION The Code for the Investigation of Marine Casualties and Incidents was adopted in 1997 noting that timely and accurate reports identifying the circumstances and causes of casualties and incidents contribute to enhancing the safety of passengers, crew and the environment. The code recognises the need for a standard approach to incident investigation (Resolution A.849(20), IMO, 1997a). However, no methodology is provided in the code, but the appendix of resolution A.849 (20) enumerates the guidelines to assist investigators in the implementation of the code.

Noteworthy is that in 1997, IMO adopted the Human Element vision (Resolution A.850(20) IMO, 1997b). This is reflected in the Amendments to the Code for the Investigation of Marine Casualties and Incidents in 1999 (Resolution A.884(21) IMO, 2000b). The amendments provide Guidelines for the Investigation of Human Factors in marine accidents. Herein, the IMO has made reference to accident causation models

– the Hybrid model (Liveware, Hardware, Software, Environment: SHEL and Swiss Cheese) and Generic Error Modelling System (GEMS) of Reason (1990). The SHEL model is borrowed from the aviation industry (Hawkins, 1987). Accident investigation models are discussed in depth in the literature review chapter (number 2). More recently, resolution A.1075(28) (IMO, 2014a) revokes both resolutions A.849(20) and A.884(21) mentioned above.

The Code of the International Standards and Recommended Practices for a Safety Investigation into a Marine Casualty or Marine Incident was adopted in MSC 84, 2008 vide Resolution MSC.255(84). The code was made mandatory with inclusion into the SOLAS convention (chapter XI-1/6) vide Resolution MSC.257(84) and came into effect in 2010. The main objectives of the code are to provide a common approach for the conduct of investigations to promote learning and prevent such incidents from recurring in the future (MSC-MEPC.3/Circ.2, IMO, 2008). Revised Harmonised Reporting Procedures for reports required under the SOLAS I/21 and XI-1/6 and MARPOL (Marine Pollution, (IMO, 1973/1978) articles 8 and 12 are given in MSC- MEPC.3/Circ.4 (IMO, 2013a).

The IMO sub-committee on Flag State Implementation in its 19th session in Dec 2010 included the study on human and organisational factors by WMU, under the category of casualty statistics and investigations (IMO, 2010a). The WMU study was based on a PhD study by Ghirxi (2010), (also see Schröder-Hinrichs et al., 2010). The committee noted WMU’s findings that the errors committed by operators at the sharp end were over represented and organisational and supervisory factors were scarcely identified in the investigation reports. This led to the conlusions that the investigators either are, not completely aware of the casualty investigation guidelines or have difficulty in applying them. Some accident investigation reports were found to have been prematurely terminated which did not allow for supervisory and organisational factors to be identified. Guidance on the importance of organisational factors and their identification were absent which could have contributed to the findngs of the study

6 which were skewed towards operators at the sharp end. Lack of harmonisation in the reports across flag states was also identified as reports were of varying levels of detail. This dissertation focuses on exploring the accident processes and not solely on the inclusion of human factors, however, this study will reveal findings on identification of human factors in passenger ship accidents as this study utilises the HFACS taxonomy, similar to Ghirxi (2010) and Schröder-Hinrichs et al. (2010). A study by Korolija and Lundberg (2010) has revealed the differing and emergent meanings of human factors for professional investigators in transport sector in Sweden, including maritime. This points to the lack of harmonisation in the understanding of the concept of human factors.

The background of the dissertation has been presented in section 1.1 and the aim, purpose and motivation for the dissertation is presented in the folowing section (1.2).

1.2 AIM, PURPOSE AND MOTIVATION FOR THE DISSERTATION The motivation for this dissertation stems from the tragic passenger ship accidents that continue to take place even in the 21st-century. In line with the aim of Schröder (2004), this dissertation aims to evaluate accidents to understand and identify why certain unfolding processes during an accident situation lead to a safe system state while others lead to a mitigated loss and some tragically result in a total loss involving fatalities. The purpose of the dissertation is twofold, on the one hand, the project studies accident investigation reports to analyse the processes in-depth while on the other, the project is an evaluation of the SEMOMAP model itself. The research questions identified for the dissertation are provided in the following subsection.

1.2.1 RESEARCH QUESTIONS In continuation of Schröder (2004), the research aims to study the complex unfolding of the accident process and will increase the knowledge of accident processes for specific maritime accident categories (fire, flooding and grounding) and the barriers, if any, that shaped the path and influenced the accident outcome from a near miss to a

7 mitigated loss to a total loss. The research questions addressed in the dissertation are provided below. o Is the maritime industry specific SEMOMAP suitable to explore maritime accidents? o What is it about the unique unfolding of the accident process on board and the shipboard behaviours and barriers, if any, that can lead to different accident outcomes for different accidents. o What are the common processes in emergency situations on-board in case of fire, grounding and foundering? o How much time is available to recover from an emergency situation during the different phases of the accident? o How realistic is the time limit of 30 minutes required for abandoning ship, post breach of threshold.

1.3 STRUCTURE OF THE DISSERTATION This dissertation is divided into six chapters. The first chapter of the study introduced the background, aims, objectives and the motivation for the dissertation. The chapter presented the research problem against the backdrop of IMO’s work on passenger ship safety as well as casualty investigation. The chapter also presented the research questions of the dissertation and provided an overview of the structure of the study. Chapter 2 is the literature review chapter which reviews prevalent accident causation models, investigation methods and related taxonomies for coding data. This chapter also makes a comment about the state-of-the-art of maritime accident investigation methods in particular. This chapter provides a background to the SEMOMAP model and justifies its need in the accident investigation domain.

Chapter 3 presents the methodology adopted in the dissertation. It presents the SEMOMAP model in great detail. The chapter also presents the two complementary taxonomies that support the SEMOMAP model and lend a comprehensive focus to the model, while at the same time integrating the human factors in accident investigation.

Chapter 4 is an empirical findings chapter. The chapter clarifies the model and the taxonomy with the help of a case study example that takes the reader step-by-step through the application of the SEMOMAP model. The chapter presents the findings from the analysis of fifteen passenger ship accident investigation reports. Reports are examined and analysed with the application of the model; data is coded step-by-step using the taxonomies and the analysis is iterated as required by the accident processes depicted in the report. The findings for the different categories of maritime accidents are collated and presented in chapter 4.

Chapter 5 reflects on the dissertation results and SEMOMAP model.

Chapter 6, the final chapter concludes the dissertation, presents the impact of the findings for IMO, academia, industry and seafarers. The chapter provides the conclusions of the dissertation and makes appropriate recommendations as required.

2. ACCIDENT CAUSATION MODELS – A LITERATURE REVIEW1

This chapter presents a state-of-the-art of accident causation models (sequential, epidemiological, socio-technical and systemic) and analysis methods. This chapter also refers to the pertinent taxonomies that support accident investigation. This chapter identifies the gaps in the literature and justifies the need for SEMOMAP in maritime accident investigation domain.

Shipping is regarded as a high risk industry similar to aviation, nuclear, chemical and the like. The high-risk nature of the industry and the consequential huge losses make it imperative that accident investigation is robust to serve its purpose. The need for accident investigation as a learning opportunity is widely recognised and lessons can be drawn to prevent recurrences in the future. Accident causation models, investigation methods and taxonomies are the tools at the disposal of investigators to commence their analysis in the aftermath of an accident. Accident investigation is also a moral responsibility of the administrations towards citizens.

15 years prior to the Costa Concordia accident Rasmussen (1997, p.183), in the context of risk management has asked whether, ‘we actually have adequate models of accident causation in the present dynamic society?’ He argues for a, ‘model of behaviour shaping mechanisms in terms of work system constraints, boundaries of acceptable performance and subjective criteria guiding adaptation to change’ (1997, p.183). The adequacy and suitability of accident investigation models continues to be open for academic deliberation.

1 The student has presented a version of the state of the art of accident investigation models in MSEA 252 course assignment on Risk Management.

Accident causation models for investigating the causes of industrial accidents began with Heinrich (1931). Accident investigation models, supportive taxonomies, safety, risk and reliability analyses have evolved over the major part of the century. Today several models and analysis methods are currently in use (Hollnagel, 1998, Kirwan, 1994, Reason, 1990, Reason, 1997a, Kristiansen, 1995, Hollnagel, 2004, Reason, 2008, Qureshi, 2007). The IMO, in its work promotes the investigation of casualties and incidents (IMO, 1997a, IMO, 2000b, IMO, 2013a, IMO, 2014a) to promote learning and stop accidents from recurring. Learning from accidents, contributes to the ‘collective memory’ that has been identified as ‘missing’ by Schröder-Hinrichs (2013). Organizations in the Maritime domain need to learn from risk (Manuel, 2012) in order to mitigate it. The following section (2.1) reviews the prominent sequential, epidemiological and systemic models of accident causation that shape subsequent investigations.

2.1 SEQUENTIAL, EPIDEMIOLOGICAL AND SYSTEMIC MODELS This section discusses the three types of accident causation models characterized by Hollnagel (2004) as sequential, epidemiological and systemic. The section provides an overview of the models and their suitability to the different kinds of accidents under investigation.

Models of accident causation, inform the choice of the related methods suitable for accident investigation and they should complement each other (Katsakiori et al., 2009, Underwood and Waterson, 2013). In a Maritime context, the investigating body requires a suitable model for the focus of its investigation. A taxonomy suitable to the model is chosen/adapted/developed to inform the data gathering methods for analysis as done by Schröder-Hinrichs, Baldauf & Ghirxi (2011) and Schröder-Hinrichs et al. (2013). Accident investigation methods are different from accident causation models. The methods are the tools that help in data gathering in line with the philosophy of the models. A state of the art of accident investigation methods has been carried out by several authors (Hollnagel and Speziali, 2008, Sklet, 2004, Katsakiori et al., 2009).

Accident causation models have been divided into three main groups, 'general models of the accident process', 'models of human error and unsafe behaviour' and 'models of human injury mechanics’ (Lehto and Salvendy, 1991). However, this dissertation, utilizes the characterization by Hollnagel (2004) that addresses accident causation as a whole and does not differentiate between the models on the basis of human injury, human error, behaviour and process.

2.1.1 SEQUENTIAL MODELS OF ACCIDENT CAUSATION Sequential accident causation models are the simplest models that describe the ‘one after the other’ linear order of the sequence of events. The sequential model is suitable when there are specific causes of the accident and well-defined links between the events. The sequential models recognize that the accident can be prevented by removing any one of the factors in the sequence (Hollnagel, 2004). Two prominent examples of the sequential models are the Domino theory of Heinrich (1931, Heinrich, 1980) and fault trees.

Figure 4: Heinrich’s Domino Model of Accident Causation Source: Qureshi (2008, p.11)

2.1.2 EPIDEMIOLOGICAL MODELS OF ACCIDENT CAUSATION The term ‘epidemiological’ comes from the bio-medical domain and describes accident causation like the, ‘spreading of a disease’ (Hollnagel, 2004, p.54). Epidemiological models acknowledge that accidents have several contributory factors and take into account the latent conditions (pathogens), barriers, environmental conditions together with contributory causes of the accident. A prominent example of the epidemiological model is Reason’s Swiss cheese model (1997b). It is complex linear in outlook and when the holes align, barriers are breached and accidents occur.

Figure 5: Swiss Cheese Model Source: Reason (1997)

The Swiss cheese model takes into account the attributing ‘blunt end factors far removed in space and time’ and the ‘sharp end factors at work here and now’ (Hollnagel, 2004, p.63). The decision-makers, line management, preconditions for unsafe acts, defences and/or barriers, unsafe acts taken together provide the anatomy of the accident. Accidents are considered to be preventable by strengthening defences/barriers.

2.1.3 SYSTEMIC MODELS OF ACCIDENT CAUSATION Systemic models address the system as a whole. Accident investigation models have evolved from identifying single causes to multiple causes of accidents to unforeseen complex emergent outcomes (Perrow, 1984). Systems need to be understood in their entirety to maintain the health of the system and prevent accidents. An understanding of the complex interactions and combinations is required with respect to the mutually interacting variables. Accident investigation models have evolved from a ‘person approach’ holding an individual responsible to a ‘system approach’ where the focus is not on ‘who blundered, but how and by the defences failed’ (Reason, 2000). The nature and perception of risk has evolved over time. Risk needs to be understood to be mitigated and understanding risk is difficult in increasingly complex socio-technical systems (Hollnagel, 2008).

In ‘Normal Accidents’, Perrow (1984) discusses interactions and coupling in a system. A nuclear power plant is the most complex intractable system with a very tight degree of coupling. Hollnagel (2008) discusses the suitability of accident causation models based on the degree of coupling and tractability/manageability. He argues that System – Theoretical Model of Accidents (STAMP) (Leveson, 2004) and Functional Resonance Accident Model (FRAM) (Hollnagel, 2004) are suitable for tightly coupled intractable systems, while Cognitive Reliability and Error Assessment Method (CREAM) (Hollnagel, 1998) is more suitable for retractable, tightly coupled systems. Another example of a system model is ACCIMAP (Rasmussen, 1997). Figure 6 on page 15 depicts the Risk Management Framework of Rasmussen (1997) and Figure 7, also on page 15 depicts the Interaction/coupling chart of Perrow (1984).

Figure 6: Risk Management Framework

Source: Rasmussen (1997)

Figure 7: Interaction / coupling chart

Source: Perrow (1984, p.327)

2.2 EVALUATION OF SEQUENTIAL, EPIDEMIOLOGICAL AND SYSTEMIC MODELS: ADVANTAGES AND DISADVANTAGES The simple linear cause-and-effect models fail to depict the complexity of accident causation and therefore are unsuitable for the purpose of analysing complex accidents. The Swiss cheese model has been considered suitable to analyze accidents in domains which are tightly coupled and tractable/manageable as in the case of Maritime transport (Hollnagel, 2008), which features in the first quadrant of Perrow (1984, p.327) and is considered less complex than a nuclear power plant. The Swiss cheese model can provide a comprehensive picture of the accident under several categories of unsafe acts, conditions, supervision and organizational. Therefore, the epidemiological model is suitable in analysing complex accidents (Le-Coze, 2013). The aim is not to state which model is better, but to identify the model which is fit for purpose/suitable with respect to the accident investigation. The sequential model is simplistic, it cannot address complexity, multiple actors or multiple factors. The sequential model is suitable for loosely coupled, tractable simple systems. The sequential model provides an identification of the active causes of the accident and does not address the underlying latent contributory factors. Therefore the sequential model does not do justice to the accident investigation of complex accidents. Neither does the sequential model identify all the information for the investigator(s) and nor does it promote learning from the accident to prepare the organization if a similar accident were to recur in the future

“if Maritime safety is to be sustainably improved, a systemic focus must be adopted in future accident investigations” (Schroder-Hinrichs and Hollnagel, 2012, p.1)

Accident models have evolved into systemic that follow a holistic system approach. This approach considers the fallibility human beings and the focus has shifted from identifying individual human errors to barriers, safe guards and defences to understand why they failed (Reason, 2000). A systemic model addresses the

complexity in critical and complex socio – technical systems made up of regularly interacting interrelated interdependent components.

2.4 MARITIME SPECIFIC MODELS Schröder (2004), provides a state of the art regarding the ‘models and approaches used for maritime casualty analysis’. He finds that some models are generic, while the others – CASMET, TRIPOD (Reason, 1997a), Loss Causation Model (DNV) focus on accidents from the organisational perspective. Schröder (2004) expands on the SEMOMAP model developed by him and the related taxonomy, particularly for the maritime industry (also see Schroder and Hahne, 2003). The SEMOMAP explores the accident process and focuses on the question, ‘why some accidents develop into total losses and while others can be successfully mitigated at a certain level of the accident processes’. Schröder (2004) presents promising preliminary results for SEMOMAP. The identified gap in the academic literature is that the maritime industry has hitherto utilised generic models for analysing accidents in the maritime domain and the maritime industry specific models in existence presently, have an overtly organisational focus. In the dissertation, the student aims to work towards the validation of the SEMOMAP model as it offers a sharp maritime industry specific focus while addressing Rasmussen’s (1997) question regarding the existence of adequate models in dynamic society. Maritime accident and investigation is applied in real-world research. The model is unique as it exclusively focuses on the Maritime accident investigation domain and is not generic in its outlook. After reviewing the available models, it can be argued that the maritime industry requires improved accident investigation models that can better aid accident investigators in analysing complex accidents. Despite being sequential, SEMOMAP with it two complementary taxonomies provides a suitable answer in this respect as it is capable of capturing complexity with a comprehensive focus. SEMOMAP focuses on the accident process and acknowledges heroic contributions, if any, that helped a system to recover, which is overlooked by most models as they are reactive in focus. SEMOMAP is a sequential model, however, it is complex linear in outlook due to its comprehensiveness.

2.6 TAXONOMY FOR CODING DATA An accident investigation requires an accident causation model in line with the focus of inquiry, which encompasses the philosophy of the accident. Furthermore, a taxonomy related to the model is required for data analysis (Schröder, 2003). Reason (1997b) had not provided a taxonomy for the accompanying Swiss cheese model. The HFACS taxonomy specifically developed by Wiegmann and Shappell (2003) in aviation is in line with the philosophy of the Swiss cheese model. Apart from aviation, the HFACS has been adapted for use in diverse areas like railroad, mining etc. HFACS has been adapted for exploring machinery space fires in Schröder-Hinrichs et al. (2010) and for evaluating the inclusion of maritime human factors in IMO policy (Schröder-Hinrichs et al., 2013). A detailed overview of the adapted taxonomy for this dissertation is given in chapter 3 on Methodology. This dissertation also utilizes a second taxonomy that is inspired by TRACEr (Shorrock and Kirwan, 2002) as the dissertation looks at the accident processes which involve human-machine interaction and therefor the HFACS alone is not considered sufficient for this study. The TRACEr inspired taxonomy helps to evaluate the different accident phases while taking into account the human-machine interaction. The adapted HFACS taxonomy and the TRACEr inspired taxonomies are discussed in detail in chapter 3 of the dissertation and are provided in the accompanying appendices.

2.7 CONCLUSION As a responsible Maritime Administration, learning from accidents is a crucial aspect to prevent future recurrences. Accidents such as the Costa Concordia go beyond the organisation and impact the national, supranational and the international domain (Schröder-Hinrichs et al., 2012). ‘What-You-Look-For-Is-What-You-Find’ and ‘What-You-Find-Is-What-You-Fix’ are two principles discussed by Hollnagel (2008 cited in Schröder-Hinrichs, Hollnagel & Baldauf, 2012). These two principles show the limited outcome of traditional accident investigations. Identifying and holding individuals responsible in complex accidents such as the Costa Concordia, defeats the very purpose of accident investigations and does not benefit society in the long

run. The limited viewpoint does not help to learn from the accident and the industry might witness another similar accident in the future, as in the case of the Costa Concordia which occurred a century after the Titanic, and the disastrous Sewol ferry accident which took place in 2014 before the final salvage operation for the Costa Concordia could be completed.

The efficiency – thoroughness trade – off (ETTO) (Hollnagel, 2009) principle is faced by the workers in their day-to-day lives and it is the duty of the investigating body to ensure the practices and the conditions leading to the safety culture on-board are identified together with their complexity. Reason (2000) argues that the culture of High Reliability Organizations (HRO) helps to make the system robust and resilient. High reliability organizations have an enhanced safety culture which is supported by an effective reporting culture and a just culture (Reason, 1998). The recurrence of accidents highlights that organizations don’t learn from accidents. An enhanced safety culture is the need of the Maritime domain which will enhance resilience and contribute to heroic recoveries at the edge of error (Reason, 2008).

Research on accident causes (for MaRCAT, see Cafferty and Baker, 2006, Caridis, 1999) does not capture the in situ unfolding of the accident process with a focus on human machine interface (HMI) while at the same time identifying the HFACS factors that impact on-board human operators and technical subjects as SEMOMAP.

This literature review chapter has discussed the state of the art of accident causation models and evaluated their suitability for investigating the different domains. The chapter also discussed maritime specific models and identified that SEMOMAP is the only model with a maritime focus that enables the study of the unfolding accident process. The chapter also discussed the need for an appropriate taxonomy to support data analysis in line with the vision of the model. This chapter has justified the need for SEMOMAP in maritime investigations. Chapter 3 on research methods utilised for the dissertation, follows after the review of literature.

3 RESEARCH METHODOLOGY

This chapter pertains to the research methodology adopted in the study and particularly to the application of the SEMOMAP accident investigation model with the help of a case study example.

3.1 RESEARCH METHODOLOGY AND SAMPLE SELECTION The research methodology adopted in the study involves the analyses of fifteen accident investigation reports along the philosophy of the SEMOMAP model. Each individual report is studied in detail and coded according to the two taxonomies of HFACs and a taxonomy inspired by TRACEr. The HFACs taxonomy was initially developed in aviation by Wiegmann and Shappell (2003). HFACS primarily deals with underlying causal human factors of an accident, while TRACEr, also from aviation (Shorrock and Kirwan, 2002) takes into account the human machine interface and is useful for both the retrospective and the predictive analysis of issues in accidents. HFACs has been adapted for the maritime domain previously in the investigation of machinery space fires and explosions by Schröder-Hinrichs et al. (2010). This dissertation takes the application of SEMOMAP further to passenger ship accidents.

The sample selection of the accident investigation reports for the dissertation requires further enumeration. The fifteen reports selected for the study are of passenger ship accidents that have taken place from 1998 onwards. The benchmark year of 1998 has been selected as it was the year of the introduction of the ISM code and in this respect it would be safe to assume that the ships would have a functional SMS on board to comply with the regulations. In addition, the training requirements for personnel in crowd management and control for assisting passengers during emergency situations,

including for evacuation (IMO, 1997c) as given in the STCW code, Chapter V, would also be reflected in the sample after the introduction date of January 1999. Table 12 on page 46 lists the sample of fifteen accident investigation reports of passenger ship accidents analysed in this dissertation.

3.2 SEMOMAP SEMOMAP was developed during the PhD research study of Schröder (2004). SEMOMAP poses the question and seeks to answer why some processes in an accident lead to a recovery of the safe system state while others lead to a mitigated or a total loss? SEMOMAP is inspired by human recovery and error management. The philosophy behind SEMOMAP is that the outcome of an incident hinges on a number of critical processes. Catastrophic events can be averted if these processes are correctly accomplished at any point, before or after the commencement of the accident timeline. Depending upon when the incident is averted, the vessel can suffer various degrees of loss, or even, no loss at all.

SEMOMAP specifically focusses on the accident process, emergency management and within it, the human operator. SEMOMAP has evolved significantly from 2004 when it was conceptualised. The SEMOMAP model from 2004 is depicted in figure 8 and the current 2014 model is depicted in figure 9. SEMOMAP has evolved significantly as a model, is sharper in focus and comprehensively embraces the accident process. The accompanying taxonomy of SEMOMAP has also evolved significantly and will be discussed subsequently in the chapter.

Previously SEMOMAP sub-divided the accident processes into 6 stages/results; dangerous situation, beginning accident, near miss, accident, mitigated loss and total loss (see figure 8). The current model (figure 9) clearly differentiates between the 4 phases of the accident (contributory factors, beginning of the accident, accident and evacuation) and the 5 results/outcomes of the processes (recovery, mitigated/severe/ total loss with and without casualties).

Figure 8: SEMOMAP in 2004 Source: Schröder (2003 cited in 2004)

detection

Organisational

Failure

Technical

Human

failure failure

failure

Dangerous situation

yes

Beginningaccident

assessmt

Situation

Dangerous

situation

yes

response

Initial

yes

recovered

System

yes

Near miss

assessment

System

Further

input

data

Safe

recovery

possible

System

shipboard

Accident

yes

operational

Abandonship

response actions

externalsupport

Preparation

Emergency

evacuation

Callingfor

status

recovered

System

yes

Release

system

Emergency

Evacuation

Monitoring

evacuation

External

support support

delay

Stop

recovery

external

Total loss Mitigated loss

)

Figure 9: SEMOMAP in 2014; Source: Schröder-Hinrichs (2014)

The 4 phases of the current SEMOMAP Model (figure 9) are provided along the top. They are: phase 0 - contributory factors that led to a dangerous situation on board, phase 1 - beginning of the accident, phase 2 - accident itself and phase 3 - evacuation. The results/outcomes are given along the bottom. The five results/outcomes of the accident process in SEMOMAP are the return to safe operation after taking appropriate action to mitigate the threat; depending upon the time of threat detection, analysis and threat mitigation actions, the outcomes can range from a mitigated loss to a severe loss; the extreme outcome of an accident is total loss of the vessel, with and without causalities.

3.2.1 SEMOMAP ‘PHASE 0’ – CONTRIBUTORY FACTORS The 2014 SEMOMAP model regards the first phase of the accident as phase 0, in which the contributory factors that led to the creation of a dangerous situation on-board are identified. At this juncture, the adapted HFACS taxonomy is used to help identify the latent conditions and contributory factors of the accident. This phase occurs prior to the incident. The evaluation of the issues suggests that if the issues have been resolved then the incident does not take place and the vessel is considered safe. However, if the evaluation reveals that the issues have not been resolved then the accident enters the second phase. The adapted HFACS taxonomy used in the study is discussed in detail in section 3.3.

3.2.2 SEMOMAP ‘PHASE 1’ – BEGINNING ACCIDENT The second phase of the SEMOMAP is referred to as phase 1 which looks at the beginning of the accident. At this stage, the accident is considered to be preventable by performing suitable and adequate preventive actions that can help to recover from the incident. Phase 1 commences as there is an imminent risk of incident due to the unresolved issues from the preceding phase 0. To return to a safe system state, indicated threat of imminent risk needs to be detected, analysed and appropriate preventive actions need to be undertaken. If the actions are successful then the system returns to safe operations and if unsuccessful, then the model evaluates if any further

measures were tried. If ‘Yes’, the loop iterates back and if, ‘No’, the model evaluates if there is a risk of other incidents. If ‘Yes’, the loop iterates back and if, ‘No’, the model enters the third phase of the accident. Incident categories can go together as in the case of collision and foundering in the Costa Concordia accident. SEMOMAP allows for studying accident processes as it enables the iteration to explore further threats to the ship system. SEMOMAP is a sequential model, but its iterative investigative capacity makes it complex linear in outlook. Phase 1, 2 and 3 of the accident utilise the taxonomy based on Hollnagel (1998), Kirwan (1994) and TRACEr.

3.2.3 SEMOMAP ‘PHASE 2’ – ACCIDENT The third phase of the SEMOMAP is the accident phase, in which the incident has occurred. It is referred to as phase 2. At this stage, the accident could still be contained to limit losses. Once the incident has occurred at the beginning of phase 2, the system health indication needs to be detected, analysed and appropriate emergency response measures need to be taken. If the emergency response measures are successful, the model helps assess, if the vessel can sail unassisted to port - If ‘Yes’, it is a mitigated loss and if, ‘No’, it is a severe loss. If emergency response measures are unsuccessful, then the model evaluates if any further measures were tried. If ‘Yes’, the loop iterates back and if, ‘No’, the model evaluates if there is a risk of other incidents. If ‘Yes’, the loop iterates back and if, ‘No’, the model enters the final phase of the accident. SEMOMAP allows comprehensive iteration to evaluate the existence of other related threats in phase 1 and 2 of the accident process.

3.2.4 SEMOMAP ‘PHASE 3’ – EVACUATION The final phase of the accident is phase 3 in which evacuation and related emergency response is the best option under the circumstances. At this stage casualties to human life can be limited to zero with appropriate evacuation processes and procedures. In this phase the evacuation measures are put in place and emergency response actions continue to fight for time. System health indication in the final accident phase needs to be detected and analysed. If other measures are tried, the loop iterates back and if

no further measures are tried and evacuation measures are successful, there is a degree of loss without casualties. If evacuation measures are not successful, there is a degree of loss with casualties. The model is comprehensive and allows for analysing complex accidents. The following sub-section discusses the SEMOMAP taxonomy in detail.

3.3 SEMOMAP TAXONOMY The SEMOMAP model utilises a very comprehensive taxonomy for data coding and analysis. The full taxonomy along with the accompanying codes is provided in the codebook in the appendix.

3.3.1 SEMOMAP TAXONOMY APPLICABLE TO ACCIDENT ‘PHASE 0’ Table 0.1 of the taxonomy is applicable to phase 0 of the accident (see appendix). It is based on HFACS and suitable for identifying the factors that led to the dangerous situation on-board. The taxonomy allows for a four level coding for each of the four identified contributory aspects (unsafe acts, pre-conditions for unsafe acts, supervision and organisational influence). The operators (human subjects) and equipment (technical subjects) affected need to be identified and coded first. See table 2 for the 5 contributory aspects and first three levels of coding. The complete taxonomy table with the fourth level of detail is given in the appendix.

Table 1: Subjects affected by influencing factors (applicable to phase 0) Source: Table 0.1 SEMOMAP Taxonomy Codebook (see appendix) Captain & Officers Captain, 1st/Chief; 2nd; 3rd; Other Officer,

Navigators Helmsman, Pilot Other crew AB, Bosun, OS

Human

Subjects Engineers 1st/Chief Engineer, 2nd/Other Engineer Bridge & Deck Steering equipment, Navigation aids (AIS,

ECDIS, GPS etc.), Communication equipment, Alarm panels & system Engine room Main / auxiliary engine, engine control panel, fuel / ballast water pumps, generators, boilers

Subjects Technical Ship structure & design Hull, separators

Table 2: SEMOMAP Taxonomy ‘phase 0’; factors leading to the dangerous situation; adapted HFACS Source: Table 0.1 SEMOMAP Taxonomy Codebook (see appendix)

Lack of human resources Poor technological resources Resource Management Poor equipment / facility resources Disorganized structure Organizational climate Inadequate policies Poor work culture Organizational Influences I Poorly designed operations Organizational process Inappropriate procedures Lack of oversight Poor international / national standards Statutory factors Inadequate flag state implementation Inadequate supervision Poor shipborne and shore supervision Planned inappropriate Poor shipborne operations Supervision II Operations Failed to correct known Shipborne related shortcomings problems Supervisory Violations Shipborne violations Poor physical environment Environmental Factors Poor technical environment Negative cognitive factors Preconditions III Crew Condition Poor physiological state Poor crew interaction Personnel Factors Poor personal readiness Skill based errors Errors Decision and judgment errors Unsafe Acts IV Perceptual Errors Routine Violations Exceptional

A further, fourth level of detail of table 2 is provided in the taxonomy codebook in the appendix. Table 1 and 2 are part of the phase 0 taxonomy of SEMOMAP and enable the identification and coding of factors that led to the creation of a dangerous situation on-board in line with HFACS. A unique aspect in this instance is that SEMOMAP allows for the identification and coding of the factors against each of the human and technical subjects individually for an accident, thus leading to a more comprehensive

evaluation. Figure 10 below depicts the relation between the phase 0 taxonomy depicted in table 1 and 2.

Figure 10: Relationship between Table 1 and 2 of taxonomy applicable to phase 0 Source: Student, based on taxonomy

Organizational Influences Human Subjects Supervision

Technical Subjects Preconditions

Unsafe Acts

3.3.2 SEMOMAP TAXONOMY APPLICABLE TO ACCIDENT ‘PHASE 1’ It is noteworthy that the taxonomy utilised in accident phase 1, 2 and 3 are inspired by Hollnagel (1998), Kirwan (1994) and TRACEr. Phase 1 pertains to the beginning of the accident. Taxonomy tables 1.1, 1.2 and 1.3 are applicable to this phase (see codebook in appendix) The SEMOMAP taxonomies allow for the identification of barriers, recovery processes, human-machine interaction and threat mitigation actions undertaken during the unfolding accident situation. Table 3 (taxonomy table 1.1) essentially pertains to the risk faced by the system

Table 3: ‘Risk of’ incident; taxonomy table 1.1 Applicable to ‘phase 1’ Source: Table 1.1 SEMOMAP taxonomy codebook (appendix 2) Collision Navigational Incidents Grounding Contact Fire Explosion Structure Failure Onboard Incidents Engine Failure Loss of Control Equipment Damage Entire Vessel Incidents Capsize/Listing; Flooding/Foundering Personnel Incidents Occupational accident

In the first instance, the threat faced by the system is ascertained. Thereafter taxonomy table 1.2 is applicable, which is the data table for phase 1 of the accident and is subdivided into three main categories – navigational incidents, on-board incidents and entire vessel incidents. Accordingly threat indication has to be detected, analysed and appropriate preventive action undertaken. Table 1.2 allows for five levels of coding (see appendix). Taxonomy table 1.2 is graphically depicted in figure 11 below. The taxonomy (1.2) includes the equipment (objects), persons and actions that were involved in the phase.

Figure 11: Diagrammatic representation of taxonomy table 1.2 applicable to ‘phase 1’ Source: Student, based on taxonomy

Navigational On-Board Entire-Vessel Incidents Incidents Incidents

Threat Threat Threat Prevention Threat Analysis Indication Detection Action

On-board Ashore Off board

Equipment Human Action

Taxonomy table 1.3 (see appendix), allows in-depth coding of the human machine interaction and the accident processes that occurred in the beginning accident phase. The table allows for five levels of coding and addresses the aspects of threat indication, threat detection, threat analysis and initial threat prevention action undertaken in the beginning accident phase. This phase covers how an accident could have been avoided altogether. The taxonomy of this phase evaluates the functioning

of specific threat indicator, detector, analyser and action with respect to human and/or equipment failure. The graphical representation of taxonomy 1.3 is given in figure 12.

Figure 12: Diagrammatic representation of taxonomy table 1.3 applicable to ‘phase 1' Source: Student, based on taxonomy

Information recording Information recording Specify human failure Threat Which specific indicator applicable? Threat Which specific indicator Indication did not function? Information Specify equipment transmission applicable? failure

Information receiving applicable? applicable? Which specific threat Specify human failure Threat Information evaluation Specify human failure detector did not Detection function? applicable? Specify equipment Information failure transmission applicable?

Information receiving applicable? Threat Which specific threat Specify human failure analyser did not Planning applicable? Analysis function? Specify equipment failure Decision making applicable?

Communication applicable? Initial Threat Which specific threat Specify human failure Prevention prevention action did Timing and sequence Action not work? applicable? Specify equipment Selection & quality failure applicable?

The coding of taxonomy table 1.3, goes deeper and comprises 5 levels. If in level 3, an aspect is applicable but not successful, then the failure is identified in level 4 and further elaborated in level 5.

3.3.3 SEMOMAP TAXONOMY APPLICABLE TO ACCIDENT ‘PHASE 2’ Once the accident enters the second phase, taxonomy tables for the second phase (2.1, 2.2 and 2.3 see appendix) are applicable. In the beginning of phase 2, the accident in the system is identified and acknowledged utilising a similar taxonomy given in table 3 on page 28. In this phase, the accident has taken place and system health needs to be ascertained. First the system health needs to be indicated, detected, analysed and appropriate emergency response needs to be taken. The 2.2 taxonomy includes the equipment (objects), persons and actions that were involved in the phase.

Figure 13: Diagrammatic representation of taxonomy table 2.2 applicable to ‘phase 2’ Source: Student, based on taxonomy

Navigational On-Board Entire-Vessel Incidents Incidents Incidents

System Health System Health System Health Emergency Indication Detection Analysis Response

On-board Off board Ashore

Equipment Human Action

Taxonomy table 2.3 pertains to how an accident could have been contained in the face of danger. Taxonomy table 2.3 is depicted graphically in figure 14. The taxonomy delves deep to specify the details of human and equipment failure which occurred due to applicable but unsuccessful outcomes. This taxonomy table answers why certain aspects were unsuccessful in the context of the accident.

Figure 14: Diagrammatic representation of taxonomy table 2.3 applicable to ‘phase 2’ Source: Student, based on taxonomy

Information recording Specify human failure System Health Which specific system applicable? health indicator did not Indication function? Information Specify equipment transmission applicable? failure

Information receiving applicable? System Health Which specific system Specify human failure health detector did not Information evaluation Detection function? applicable? Specify equipment Information failure transmission applicable?

Information receiving applicable? Which specific system Specify human failure System Health Planning applicable? health analyser did not Analysis function? Specify equipment Decision making failure

applicable? Communication applicable? Emergency Which specific Specify human failure Response responsive action did Timing and sequence Action not work? applicable? Specify equipment failure Selection & quality applicable?

3.3.4 SEMOMAP TAXONOMY APPLICABLE TO ACCIDENT ‘PHASE 3’ Once the accident enters phase 3, evacuation is necessary to limit loss of life and emergency and evacuation procedures get underway. Taxonomy tables 3.2 and 3.3 (see appendix) are applicable in phase 3 of the accident. Taxonomy table 3.2 is depicted diagrammatically in figure 15 and contains the objects, persons and actions involved in the final phase. Taxonomy table 3.3 is given in figure 16 and covers how an accident could have been contained to limit losses in the face of danger. In the evacuation phase, the crucial aspect is to protect human lives and limit fatalities. In the final phase of the accident emergency response and evacuation takes precedence over system health indication, detection and analysis.

Figure 15: Diagrammatic representation of taxonomy table 3.2 applicable to ‘phase 3’ Source: Student, based on taxonomy

Navigational On-Board Entire-Vessel Incidents Incidents Incidents

Emergency System Health System Health System Health Response & Indication Detection Evacuation Analysis

On-board Off board Ashore

Equipment Human Action

Figure 16: Diagrammatic representation of taxonomy table 3.3 applicable to ‘phase 3’ Source: Student, based on taxonomy

Communication applicable? Emergency Specify human failure Which specific system Response & health indicator did not Timing and sequence Evacuation function? applicable? Specify equipment Actions failure Selection & quality applicable?

Information recording applicable? Specify human failure System Health Which specific system Indication health detector did not function? Information Specify equipment transmission applicable? failure

Information receiving applicable? Specify human failure System Health Which specific system Information evaluation health analyser did not applicable? Detection Specify equipment function? failure Information

transmission applicable?

Information receiving applicable? Specify human failure System Health Which specific Planning applicable? Analysis responsive action did not work? Specify equipment failure Decision making applicable? 33

In the third and final phase of the accident in SEMOMAP, emergency and evacuation actions and procedures are well underway and the personnel fight for time.

SEMOMAP reflects the Simple Model of Cognition given by Hollnagel (1998) (see figure 17) in which the data observed/identified impacts the interpretation, and the planning/choice of action/execution, though not necessarily in order. SEMOMAP also draws upon Wickens’ Model of Human Information processing (see figure 18).

Figure 17: SMoC – Simple Model of Cognition Source: Hollnagel (1998)

Figure 18: Wickens’ Model of Human Information Processing Source: Liebl et al., 2011

3.4 CONCLUSIONS This chapter has discussed the research methodology adopted for the dissertation. The rationale for the sample selection is also discussed. This chapter has presented the SEMOMAP model in great detail. The chapter has enumerated the model’s four comprehensive accident phases (0, 1, 2 and 3) and the results / outcomes of the maritime incident. The chapter has also discussed in detail the SEMOMAP taxonomy applicable to each of the phases and the philosophy behind the taxonomy.

In addition to exploring the accident process in great detail, SEMOMAP helps to obtain quantitative data that allows for the creation of fault trees, event trees, risk contribution trees and related risk assessment diagrams. The data from the SEMOMAP analysis can also potentially be used to create improved decision support systems, which take into account the actions, inaction and time periods to provide adequate and appropriate support to shipboard personnel (see appendix, SEMOMAP codebook).

After a discussion of the research methodology in chapter 3, the following chapter presents the findings of the study.

4 ANALYSIS OF ACCIDENT INVESTIGATION REPORTS

Chapter 4 presents the findings of the analysis of the accident investigation reports. A total of fifteen publicly available investigation reports of passenger ship accidents were analysed utilising the SEMOMAP model and accompanying taxonomies. The list of accident investigation reports analysed in this dissertation is given in table 12. A more detailed list including the narratives of the accident is included in the appendix. The breakdown of the analysed accident investigation reports is given in table 4.

Table 4: Breakdown of accident investigation reports analyzed Source: Student Accident Category Fire Grounding Flooding Total Reports analyzed 8 6 1 15

The chapter opens with a solved case study example which depicts the step by step application of the taxonomy to code an accident investigation report in line with the philosophy of the SEMOMAP model.

4.1 SEMOMAP SOLVED CASE STUDY EXAMPLE The accident investigation report chosen for the step-by-step application of the SEMOMAP taxonomy is Monarch of the Seas, a Norwegian flagged ship which grounded on the Proselyte reef in Great Bay, Philipsburg, St. Maarten, Netherlands in 1998. The result of the incident was major damage to the vessel; there was no loss of life and minor pollution resulted from the incident. The brief narrative of the accident, from the investigation report is provided to familiarise the reader with the casualty. Thereafter, the step-by-step walk-through of the taxonomy application is given.

Summary At approximately 0030 hours on the night of 15 December 1998, the passenger vessel MONARCH OF THE SEAS arrived outside of Great Bay, St. Maarten in order to evacuate a sick passenger to a shore side medical facility. At 0125 the vessel’s crew completed the passenger evacuation evolution and the MONARCH OF THE SEAS departed St. Maarten, taking a South-South-easterly departure route with the intention of safely passing to the east of the Proselyte reef obstruction. At approximately 0130 hours the MONARCH OF THE SEAS raked the Proselyte Reef at an approximate speed of about 12 knots without becoming permanently stranded. Almost immediately emergency and abandon ship signals were sounded and the crew and passengers were mustered at their abandon ship stations. At 0235 the vessel was intentionally grounded on a sandbar in Great Bay, St. Maarten. By 0515 hours all 2,557 passengers were safely evacuated ashore by shore based tender vessels.

4.1.1 MONARCH OF THE SEAS ‘PHASE 0’ ACCIDENT CODING Phase 0 of an accident deals with factors that led to the creation of a dangerous situation on board. The involved human and technical subjects are identified and the HFACS aspects pertaining to them are coded first. In the chosen case study report the three human subjects identified are the captain, staff captain, second officer and the one technical subject identified is the navigational aids. The breakdown of the coding for the human and technical subjects against the organisational influences, supervision, preconditions and unsafe acts is given in table 5 on the following page. The coding is done in accordance with the SEMOMAP taxonomy table 0.1 (in line with HFACS) which is discussed in detail in chapter 3, section 3.3.1 (pp. 26 – 28).

In the coding for this phase the captain appears 37 times followed by the second officer who is coded 19 times and the staff captain who features 11 times. Navigational aids as technical subjects have one mention.

Table 5: Monarch of the Seas ‘phase 0’ HFACS coding Source: Student

category Sub category L2 Sub-sub category L3 Subject Total L1 breakdown* Resource Lack of human resources 1 M; 1 SC; 3 management 1 2/O

Organizational Disorganized structure 1 M; 1 SC; 2 climate Poor work culture 1 M; 1 SC; 3 1 2/O Organizational Poorly designed operations 2 M; 1 2/O 3 Influences process Inappropriate procedures 1 M 1 Organizational Organizational Statutory factors Poor international/ 1 M 1 national standards Organizational Influence sub-category total - 13 Inadequate Poor shipborne and shore 3 M; 2 SC; 6

supervision supervision 1 2/O Planned inappropriate Poor shipborne operations 2 M; 2 SC; 6 operations 2 2/O Failed to correct Shipborne related 2 M; 1 SC; 4 known problems shortcomings 1 2/O Supervision Supervisory Shipborne violations 2 M; 1 SC; 4 violations 1 2/O Supervision sub-category total - 20 Environmental Poor technological 2 M; 2 2/O; 5

factors environment 1 B&D Crew condition Negative cognitive factors 4 M; 2 2/O 6 Poor physiological state 3 M 3 Personnel factors Poor crew interaction 3 M; 2 SC; 6 1 2/O

Preconditions Poor personal readiness 1 M; 1 2/O 2 Preconditions sub-category total - 22 Errors Skill based errors 4 M; 2 2/O 6

Decision and judgment 1 M 1 errors

Acts

Unsafe Violations Routine 2 M; 2 2/O 4 Exceptional 1 M; 1 2/O 2 Unsafe Acts sub-category total - 13 Coding Total 68 *Subject breakdown legend: M – Master; SC – Staff Captain; 2/O – 2nd Officer; B&D – Bridge & Deck (technical subject – navigational aids)

4.1.2 MONARCH OF THE SEAS ‘PHASE 1’ ACCIDENT CODING The factors influencing the creation of a dangerous situation on board are identified in the phase 0 coding. Phase 1 of the accident pertains to beginning of the accident. This

phase first involves the identification of the threat to the vessel. On board, it requires that the threat is indicated, detected, analysed and appropriate threat mitigation action, undertaken. If suitable timely action is taken in this phase, the accident can be avoided altogether. The coding for this phase is done in line with chapter 3, section 3.3.2 (pp. 28 – 30). In the very first instance, the imminent threat to the vessel is coded, which in the case of the Monarch of the Seas is the threat of the navigational incident of grounding.

Table 6: Monarch of the Seas ‘phase 1’ coding (SEMOMAP taxonomy table 1.1) Source: Student based on taxonomy codebook Risk of Navigational incident Grounding After the threat to the vessel is identified, taxonomy table 1.2 and 1.3 are applicable which evaluate the threat indication, detection, analysis, and threat prevention action with respect to the incident applicable to the vessel. The relevant aspects on board, ashore and off-board are evaluated with respect to the equipment involved, human involvement and actions undertaken. If an aspect is applicable and not successful, it is further evaluated and the human or equipment failure is specified accordingly. In phase 1 of the Monarch of the Seas grounding accident, the vessel disembarked a sick passenger and contrary to procedure, proceeded east of the reef. The staff captain was surprised by the master’s choice, however did not say anything.

Table 7: Monarch of the Seas ‘phase 1’ coding (SEMOMAP taxonomy table 1.2, 1.3) Source: Student based on taxonomy codebook Threat Indication No threat indication Threat Detection Human Information Human failure – No threat

transmission - Staff evaluation transmitted. SC did Captain applicable but failed not challenge Master’s decision. Threat Analysis No threat analysis

Threat Prevention No threat prevention

First iteration Action action Threat Indication Equipment Information recording Human failure – No threat Sea Charts applicable but failed information recorded. OOW

Navigational Incident Grounding 2nd Onboard failed to plot position

In the case of the Monarch of the Seas, the threat is not analysed and no threat mitigation action is undertaken which moves the accident into phase 2. Noteworthy is that within the same phase, iterations can be carried out based on the number of actions.

4.1.3 MONARCH OF THE SEAS ‘PHASE 2’ ACCIDENT CODING In phase 2, the accident occurs and losses can be limited by timely and appropriate action. In phase 2 for the Monarch of the Seas, the first item to be coded is the nature of the accident that has taken place which is the navigational incident of grounding. Coding for this phase is carried out according to the phase 2 taxonomy tables discussed in detail in chapter 3, section 3.3.3 (pp. 31-32).

Table 8: Monarch of the Seas ‘phase 2’ coding (SEMOMAP taxonomy table 2.1) Source: Student based on taxonomy codebook Accident Navigational incident Grounding

Subsequent to the accident SEMOMAP taxonomy tables 2.2 and 2.3 are applicable. The system health needs to be indicated, detected, analysed and suitable emergency response needs to be carried out. For system health indication, detection, analysis and emergency response action, the aspects that did not function are identified. If an aspect is applicable but unsuccessful, then the equipment or human failure is specified. Depending upon the number of emergency actions undertaken in the phase, several iterations of taxonomy coding can be carried out.

After the grounding with the reef, in phase 2 of the accident, the system health is regularly evaluated and emergency response measures undertaken. Several emergency response actions were taken as the vessel faced an added threat of flooding. The watertight doors were closed, the speed was reduced and the master decided deliberately to ground the vessel on the sandbank to protect lives. The actions were successful and the accident entered into the final evacuation phase.

Table 9: Monarch of the Seas ‘phase 2’ coding (SEMOMAP taxonomy table 2.2 and 2.3) Source: Student based on taxonomy codebook System Health No system health Human failure – No info Indication indication recorded/ transmitted Recording applicable – Ignore system health – Failed inadequate risk assessment. Transmission applicable Omitted action – position - Failed not plotted, failed to monitor System Health Human Information receiving, Successful Detection OOW evaluation & transmission applicable

System Health Human Information receiving, Successful Analysis SC planning & decision applicable Emergency Action Communication, timing Successful

iteration Response Action ECR & sequence and selection & quality

First applicable System Health Human Information recording Successful Indication SC & transmission applicable

Grounding

- System Health Human Information receiving, Successful Detection Master evaluation & transmission

System Health Onboard Human Information receiving, Successful planning & decision

Analysis Master applicable Emergency Action Communication, timing Successful

Navigational Incident & sequence and Iteration Response Action (Safety

nd Officer) selection & quality 2 applicable System Health Equipment Information recording Successful Indication Water level & transmission indicators applicable System Health Human Information receiving, Successful Detection Safety evaluation & Officer transmission System Health Human Information receiving, Successful Analysis Master planning & decision applicable Emergency Action Communication, timing Successful & sequence and

iteration Response Action (ECR)

rd selection & quality 3 applicable

4.1.4 MONARCH OF THE SEAS ‘PHASE 3’ ACCIDENT CODING The Monarch of the Seas entered into the final evacuation phase of the accident after the deliberate grounding of the vessel by the master. In this phase SEMOMAP taxonomy tables 3.2 and 3.3 are applicable and are discussed in detail in chapter 3, section 3.3.4 (pp. 32-34). In this phase emergency response and evacuation come foremost and system health indication detection and analysis continue as required. Human, equipment and action components both on-board and ashore are evaluated and when an aspect is applicable but not successful, then the human or equipment failure is clearly specified. All crew and passengers are mustered in this step and taken ashore by shore based tenders. The outcome of the accident is that there is severe damage to the vessel, however there is no loss of life. After the accident, the timely and suitable actions of the master, staff captain, officer of the watch, safety officer, chief engineer and crew helped to recover from an otherwise potentially dangerous situation which could have resulted in loss of lives (Reason, 2008).

Table 10: Monarch of the Seas ‘phase 3’ coding (SEMOMAP taxonomy table 3.2 and 3.3) Source: Student based on taxonomy codebook Emergency Action Communication, timing & Successful Response & Muster Personnel sequence and selection & Evacuation Action (Emergency quality applicable Team)

System Health Human Information recording & Successful Indication OOW transmission applicable System Health Human Information receiving, Successful Detection Master evaluation & transmission

Grounding

- System Health Human Information receiving, planning Successful

First iteration Analysis Master & decision applicable Emergency Action Communication, timing & Successful Response & Drop anchor sequence and selection & Evacuation Action Onboard quality applicable System Health Human Information recording & Successful Indication OOW transmission applicable

System Health Human Information receiving, Successful Navigational Incident Detection Master evaluation & transmission System Health Human Information receiving, planning Successful

Iteration & decision applicable Analysis Master

Emergency Action Communication, timing & Successful Response Action Call SAR services sequence and selection & quality applicable System Health Human Information recording & Successful

Indication OOW transmission applicable System Health Human Information receiving, Successful Detection Master evaluation & transmission

iteration System Health Human Information receiving, planning Successful

rd 3 Analysis Master & decision applicable Emergency Action Communication, timing & Successful Response Action (local agents) sequence and selection & quality applicable System Health Human Information recording & Successful

Indication OOW transmission applicable System Health Human Information receiving, Successful Detection Master evaluation & transmission

iteration System Health Human Information receiving, planning Successful

th 4 Analysis Master & decision applicable Emergency Action Communication, timing & Successful Response Action Contain hull sequence and selection & damage quality applicable System Health Human Information recording & Successful Indication OOW transmission applicable System Health Human Information receiving, Successful Detection Staff Captain evaluation & transmission

iteration System Health Human Information receiving, planning Successful

5 Analysis Master & decision applicable

The coding is conducted based on the available information in the accident investigation report by the student. Graphical breakdown and results are shown for levels 1 to 4a of the taxonomy. Level 4b and 5 have not been analysed graphically, as they are reliant and dependant on coder reliability, i.e. different people might disagree with the taxonomy options selected for level 4b and 5; instead, however, levels 4b and 5 are described and discussed very broadly and subjectively.

An indicative fault tree diagram is created for the Monarch of the Seas, by the student and is presented on the following page. The diagram reflects the data that can be generated by the SEMOMAP model and accompanying taxonomy. SEMOMAP generates a more comprehensive output than the fault tree analysis as it is supported by two strong accompanying taxonomies.

Figure 19: FTA Monarch of the Seas Source: Student

Vessel grounded

Excessive water ingress, can't stay afloat

Hull damaged Beyond Repair / recovery

AND

Damage Ship collided exceeds with the rocks design safety

OR AND

Nos of W/T Unrecoverabl Failure to compartment e damage Reef identify s damaged sustained present hazard

Company Unable to A/C procedures as per plan not followed OR

AND

Master / OOW High speed Inappropriate handover Inadequate Chart in use watch Not corrected keeping

Failure of Poor training BTM / BRM

4.2 DISSERTATION RESULTS The step-by-step coding of the sample case study of the Monarch of the Seas in section 4.1 is followed by the results of the dissertation. As previously mentioned, this dissertation contains the analysis of 15 publicly available accident investigation reports, of which 8 on fire, 6 on grounding and 1 on flooding. 14 of the 15 investigated reports pertained exclusively to their accident category in question, while Monarch of the Seas discussed in 4.1 above was the only one that faced an additional threat of flooding after grounding with the reef. To mitigate the threat of flooding and protect lives it was decided to deliberately ground the vessel on the sandbank.

The breakdown of the accident outcomes is given below in table 11

Table 11: Accident outcomes of analysed passenger ship investigation reports Source: Compiled by Student

Fire Grounding Flooding 7 Mitigated loss 1 Severe loss 4 Mitigated loss 2 Severe loss 1 Near miss 8 6 1

None of the passenger ship accidents analysed, resulted in a total loss; no lives were lost in these accidents. Table 12 on the following page presents a list of the accident investigation reports analysed in the study together with the online sources for the reports. This section (4.2) first presents category wise findings specific to Fire, grounding and flooding before moving onto overall findings which encompass all the three categories.

SEMOMAP allows for the study of actions and processes in the accident context and helps identify human contribution, involved equipment and actions that contributed to the accident outcomes. Further on in the chapter the findings are collated and presented and a separate section is dedicated to the evaluation of the SEMOMAP model itself.

Table 12: List of accident investigation reports analyzed Source: Student No. Ship Name IMO No Flag Classification Nature of accident Report Source Germanischer https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations- 1 M.V. Zenith 8918136 Malta Fire Lloyds 2014.aspx Lloyds’ Register https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations- 2 M.V. Azamara Quest 9210218 Malta Fire 2012.aspx Lloyds’ Register https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations- 3 M.V. Carnival Spirit 9188647 Malta Fire 2012.aspx 9333163 Panama Lloyds’ Register Fire https://homeport.uscg.mil/mycg/portal/ep/contentView.do?chann M.V. Carnival elId=- 4 18374&contentId=460088&programId=21431&programPage= Splendor %2Fep%2Fprogram%2Feditorial.jsp&pageTypeId=13489&cont entType=EDITORIAL 9241061 United Lloyds’ Register Fire http://www.maib.gov.uk/cms_resources.cfm?file=/QM2Report.p 5 RMS Queen Mary 2 Kingdom df 6 M.V. Royal Princess 9210220 Bermuda NA Fire http://www.bermudashipping.bm RINA http://www.maib.gov.uk/cms_resources.cfm?file=/star%20prince 7 M.V. Star Princess 9192363 Bermuda Fire ss.pdf Lloyds’ Register http://www.maib.gov.uk/publications/investigation_reports/2007 8 M.V. The Calypso NA Cyprus Fire /calypso.cfm?view=print& Germanischer https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations- 9 M.V. Saga Sapphire 7822457 Malta Flooding Lloyds 2014.aspx Germanischer https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations- 10 M.V. Lauren L 9246827 Malta Grounding Lloyds 2013.aspx M.V. Clipper NA Bahamas NA Grounding http://www.tsb.gc.ca/eng/rapports- 11 Adventure reports/marine/2010/m10h0006/m10h0006.asp Germanischer http://www.bsu-bund.de 12 M.V. Deutschland 9141807 Germany Grounding Lloyds 7359400 Marshall Det Norske Veritas Grounding http://www.atsb.gov.au/publications/investigation_reports/2008/ 13 M.V. Van Gogh Island mair/pdf/mair252_001.pdf Germanischer http://www.atsb.gov.au/publications/investigation_reports/2004/ 14 M.V. Astor 8506373 Bahamas Grounding Lloyds mair/mair200.aspx M.V. Monarch of the 8819500 Norway Det Norske Veritas Grounding http://marinecasualty.com/documents/monarch.pdf 15 Seas

4.2.1 FLOODING CATEGORY OVERVIEW This section discusses the findings from the flooding accident category, of which only one report was coded. Table 13, shows the ‘phase 0’ HFACS coding for the flooding accident that led to the creation of a dangerous situation on-board.

Table 13: Flooding accident category ‘phase 0’ HFACS overview Source: Student based on taxonomy codebook Sub-Category L2 Sub-Sub Category* Operator Total L3 breakdown

Resource Management Lack of human 1 C 1 resources Organizational Climate Disorganized 1 C 1 structure Poor work culture 1 C 1 Organizational Process Poorly designed 1 C 1 operations Inadequate 1 C 1 procedures Organizational Influences Organizational Lack of oversight 1 C 1 Category total: 6

Inadequate Supervision Poor shipborne and 2 C 2 shore supervision Planned inappropriate Poor shipborne 1 C; 1 OO; 3 operations operations 1 OE Supervisory Violations Shipborne violations 2 C; 1 OO 3 Supervision Category total: 8

Environmental Factors Poor technological 2 C 2 environment Crew Condition Negative cognitive 1 C; 1 OO; 3 factors 1 OE

Preconditions Category total: 5

Errors Skill based errors 1 C; 1 OO 2 Decision and 1 C 1 judgment errors Violations Routine 1C; 1 OO 2

Unsafe Acts Unsafe Category total: 5 Coding Total 24 *Operator: C – Captain; OO – Other Officer; OE – Other Engineer

Figure 20: Flooding ‘phase 0’ operator overview Source: Student

Organisational Influences (i) Other Supervision (ii) Engineer, 1, 13% Other Officer, 2, 25% Captain, Captain, 5, 62% 6, 100%

Preconditions (iii) Unsafe Acts (iv) Other Engineer Other 1, 20% Officer, 2, 40% Captain, Captain, 3, Other 3, 60% 60% Officer, 1, 20%

Table 13 on the preceding page depicts the flooding category overview for HFACS coding and figure 20, offers the operator breakdown for each category. The Captain in figure 20 appears under all HFACS categories and occupies a large share of each category, as can be expected given his overall role on-board. The other operators that feature are the Other Officer (exact rank not given in report, but the Officer of the Watch) and Other Engineer (most probably the Engine Officer on duty). This finding also points to the level of detail included in accident investigation reports regarding operators involved.

The background to the creation of a dangerous situation on-board included the poor operational practice of utilising the Officer of the Watch for the purpose of ballast operations, which was further compounded by a poor hand/take over, thereby compromising safety. There was inadequate monitoring from both the deck and the engine department. Inadequate SMS guidelines for the operation and inadequate risk assessment, led to the dangerous situation of flooding, and the move into phase 1.

4.2.1.1 FLOODING ‘PHASE 1’ OVERVIEW The flooding had begun, however the accident had not taken place per se and the threat indication, detection, analysis and prevention were successfully carried out.

Table 14: Flooding accident category ‘phase 1’ overview (level L2B) Source: Student based on taxonomy codebook L2B Threat Indication On-board Human Other 2 L2B Threat Detection On-board Human OOW 3 L2B Threat Analysis On-board Human OOW 3 L2B Threat Prevention Action On-board Action Other 3

Figure 21: Flooding ‘phase 1’ overview (L3-4) Source: Student

Legend Applicable and Successful

In phase one of the flooding accident, the on-board human was applicable 11 times and all 11 times was successful. The good practice of on-board safety rounds helped the accident to be averted in a timely manner. The vigilant crew during the safety round, immediately reported the finding of water build up. The cause of the flooding was investigated, ballast operations were stopped and corrective actions taken, which prevented the flooding incident from progressing into phase two of the accident.

4.2.2 GROUNDING CATEGORY OVERVIEW This sub-section presents the findings of the grounding category of accidents of which 6 accidents were analysed using SEMOMAP, of which 5 were a mitigated loss and 1 a severe loss. The HFACS coding for the grounding category for human operators and equipments is provided on the following pages.

Most grounding accidents appear to have taken place due to poor communication, Bridge Resource Management and Bridge Team Management practices on-board. Inadequate risk assessment, passage planning, navigation chart correction and position monitoring are some of the aspects that feature in the reports as well as the lack of involvement of the personnel on the bridge at the time of the incident (the concerned OOW or the pilot, Staff Captain etc.). For instance, a language barrier was identified in Astor and Van Gogh grounding in Australia during departure operations as the crew on-board were communicating in Russian and Ukrainian whereas the pilot was able to understand only English and this was a complete failure of BTM and BRM.

4.2.2.1 GROUNDING CATEGORY ‘PHASE 0’ OVERVIEW Table 15 on the following page depicts the coding for the human operators involved in the Grounding category according to HFACS and Table 16 presents the technical subjects/equipment involved in the grounding accident category.

Table 15: Grounding accident category ‘phase 0’ HFACS operator overview; Source: Student, according to taxonomy

Operator Breakdown L1 Sub-Category L2 Sub-Sub-Category L3 C CO 2O OO Helmsman Pilot Total Lack of Human Resources 6 4 1 1 0 1 13

Resource Management Poor Technological Resources 2 0 0 0 0 0 2 Disorganised Structure 1 1 0 0 0 0 2 Inadequate Policies 1 0 0 0 0 0 1 Poor Work Culture 8 5 2 3 1 3 22 Poorly Designed Operations 8 0 1 0 0 0 9 Organisational Climate Inappropriate Procedures 6 0 0 0 0 0 6 Poor International/National Standards 3 0 0 0 0 0 3

Organisational Influences (i) Statutory Factors Inadequate Flag State Implementation 1 0 0 0 0 0 1 Inadequate Supervision Poor Shipborne and Shore Supervision 8 3 2 2 0 0 15 Planned Inappropriate Operations Poor Shipborne Operations 13 7 3 2 0 3 28 8 4 2 0 0 2 16

Failed to Correct Known Problems Shipborne Related Shortcomings

Supervision (ii) Supervisory Violations Shipborne Violations 11 4 2 2 0 0 19 1 0 0 0 0 0 1 Poor Physical Environment Environmental Factors Poor Technological Environment 3 0 3 1 0 1 8 Negative Cognitive Factors 10 2 3 4 0 1 20 Crew Condition Poor Physiological State 3 0 0 0 0 0 3 Poor Crew Interaction 6 4 1 1 2 2 16

Preconditions (iii) Personnel Factors Poor Personal Readiness 8 3 1 1 2 0 15 Skill-based errors 16 3 2 3 1 3 28

Errors Decision and judgement errors 10 1 1 0 0 0 12 Routine 13 5 4 3 1 1 27

Unsafe (iv) Acts Violations Exceptional 4 1 1 0 0 1 7 Operator: C-Captain; CO-Chief Officer; 20-2nd Officer; OO; Other Officer Total 150 47 29 23 7 18 274

Table 16: Grounding accident category ‘phase 0’ HFACS equipment overview; Source: Student, according to taxonomy Equipment Breakdown L1 Sub-Category L2 Sub-Sub-Category L3 Steering Navigation Aids (AIS, Other Equipment ECDIS, Radar, GPS, etc.) Total 0 1 2 3 Poor Technological Resources Resource 1 0 0 1 Management Poor Equipment/Facility Resources 1 0 0 1 Disorganised Structure Inadequate Policies 0 0 1 1 Organisational Climate Poor Work Culture 0 1 2 3 0 0 1 1 Poorly Designed Operations

Organisational Influences Organisational Process Inappropriate Procedures 0 0 2 2

Planned Inappropriate 1 0 0 1 Operations Poor Shipborne Operations 1 0 0 1

Supervision Supervisory Violations Shipborne Violations

Poor Physical Environment 1 0 1 2 Environmental Factors Poor Technological Environment 1 1 2 4 0 0 1 1

Preconditions Crew Condition Negative Cognitive Factors Total 6 3 12 21

Figure 22: Grounding ‘phase 0’ operator overview Source: Student

Figure 23: Grounding ‘phase 0’ HFACS equipment overview Source: Student

In ‘phase 0’ of the grounding accident category, HFACS categories are attributed highest to the Captain, followed by the Chief Officer and 2nd Officer. The HFACS

categories are largely attributable to the following equipment – steering equipment, navigation aids (AIS, ECDIS, Radar, GPS etc.) among others. The taxonomy can further be expanded to include these in the future.

4.2.2.2 GROUNDING CATEGORY ‘PHASE 1’ OVERVIEW The dangerous on board situation contributes to, and leads to the beginning of accident ‘phase 1’. In case of a grounding accident, threat indication is attributable to equipment like ECDIS, Echo Sounder, Radar, Sea charts among others. Threat is detected by the human operators – master and others, which includes individuals like the Staff Captain and Pilot. The taxonomy can be expanded to include these personnel for future coding of accidents. Threat analysis is largely carried out by the master and prevention actions include altering speed and manoeuvring.

Figure 24: Grounding ‘phase 1’ overview (L1-2) Source: Student based on taxonomy

Threat Indication Threat Detection

10% ECDIS 10% Master 20% 10% Echo Sounder 10% 50% Radar 40% Other 30% 20% Sea Charts No Threat Other Detection No Threat Indication Threat Prevention Action Threat Analysis

9% Altering Speed 18% 30% Master Steering & 70% No Threat 73% Manouvering Analysis No Threat Prevention Action

‘Others’ in ‘threat indication’ refers to Staff captain (2 times) and Pilot (4 times). ‘Others’ in ‘detection’ refers to the Staff captain (6 times) and Pilot (6 times). 73% of the times, threat prevention actions are not taken, which moves the accident into the next phase of the accident. Levels 3-4 of the SEMOMAP depict the applicability and success of threat indication, detection, analysis and threat prevention action.

Figure 25: Grounding ‘phase 1’ overview (L3-4) Source: Student, based on taxonomy

Threat Indication Threat Detection 12 12 10 10 2 8 4 8 4 3 2 5 6 1 6 3 3 4 4 3 6 5 2 2 3 4 0 0 2 Information Information Information Information Information Recording Transmission Transmission Receiving Evaluation Applicable? Applicable? Applicable? Applicable? Applicable?

Threat Analysis Threat Prevention Action 15 15 10 10 5 6 6 6 6 6 5 3 5 3 3 2 4 4 2 1 1 3 0 0 1 1 Information Planning Decision Communication Timing & Selection & Receiving Applicable? Making Applicable? Sequence Quality Applicable? Applicable? Applicable? Applicable?

Legend Applicable & Successful Applicable & Unsuccessful Not applicable

A threat not detected and analysed in time, does not have a corresponding mitigation action but the threat of an incident does not diminish. This level helps to study the applicable aspect and whether it was successful or not. Applicable aspects were successful 29 times and unsuccessful 31 times.

Level 4-5 of SEMOMAP taxonomy specifies human or equipment failure. Figure 26, depicts Level 4-5. This depicts the further breakdown of the ‘orange’ legend – ‘applicable & unsuccessful’ of figure 25.

Figure 26: Grounding ‘phase 1’ overview (L4-5); Source: Student based on taxonomy

Threat Prevention Action Threat Analysis 5 3.5 4 3 2.5 3 2 2 4 4 1.5 3 3 3 1 1 2 0.5 0 0 Communication Timing & Selection & Information Planning Decision Applicable? Sequence Quality Receiving Applicable? Making Applicable? Applicable? Applicable? Applicable?

Threat Indication Threat Detection

3.5 2.5 3 2 2.5 1.5 2 1.5 3 3 3 1 2 1 0.5 1 0.5 0 0 Information Information Information Information Information Recording Transmission Receiving Evaluation Transmission Applicable? Applicable? Applicable? Applicable? Applicable?

Legend Human failure specify

There is no equipment failure in phase 1 (L4-5), human failure has been noted in all 31 instances at this level. The situation further exacerbates and moves into ‘Phase 2’.

4.2.2.3 GROUNDING CATEGORY ‘PHASE 2’ OVERVIEW The accident takes place in this phase and the threat indication changes into the indication of system health, after the accident.

Figure 27: Grounding ‘phase 2’ overview (L1-2) Source: Student, based on taxonomy

System Health Indication System Health Detection

Water Level Indicators 5% 6% 5% OOW Master 21, 39% 17% 27, 50% OOW Other Other 67% Other Crew 6, 11% Member No System Health Indication

System Health Analysis Emergency Response Action 5% Offboard Action Other 5% 17% Master 20% Other OOW 78% 75% Other Reverse Thrust

System health is indicated by the equipment such as the water level indicators and crew members such as the OOW. System health is detected largely by the Master and the OOW. System health analysis is largely carried out by the Master and emergency response actions include off board action by shore based tenders to evacuate passengers, doing the reverse thrust and deliberately grounding the vessel (Monarch of the Seas) among other actions.

Figure 28: Grounding ‘phase 2’ overview (L3-4) Source: Student, based on taxonomy

System Health Indication System Health Detection 19 18.2 18 18 1 17.8 17 2 17.6 1 17.4 16 1 17.2 18 18 15 17 17 16.8 14 17 15 16.6 13 16.4 Information Information Information Information Information Recording Transmission Transmission Receiving Evaluation Applicable? Applicable? Applicable? Applicable? Applicable?

System Health Analysis Emergency Response Action 20 25 1 15 5 20 2 6 7 15 8 10 18 10 13 18 11 13 5 5 12 0 0 Information Planning Decision Communication Timing & Selection & Receiving Applicable? Applicable? Applicable? Sequence Quality Applicable? Applicable? Applicable?

Legend Applicable & Successful Applicable & Unsuccessful Not applicable

Level L3-4 of phase two of the taxonomy helps identify which aspects of system health indication, detection, analysis and emergency action were applicable and whether they succeeded or not. In phase two of the grounding accident, at this level, there have been instances in system health indication, analysis and emergency response action where there have been failures. Aspects were applicable and successful 170 times and applicable but unsuccessful 30 times.

Figure 29: Grounding ‘phase 2’ overview (L4-5) Source: Student, based on taxonomy

System Health Indication System Health Analysis 1.2 6.2 1 6 0.8 5.8 0.6 5.6 1 1 0.4 5.4 0.2 5.2 6 5 0 4.8 Information Information 4.6 5 Recording Transmission 4.4 Applicable? Applicable? Information Planning Decision Receiving Applicable? Applicable? Emergency Response Action Applicable? 10 8 6

4 7 8 2 2 0 Communication Timing & Selection & Applicable? Sequence Quality Applicable? Applicable?

Legend Human failure specify

In level 4-5 of phase 2 taxonomy, the failure can be attributable to the human or equipment and in each of the 30 cases of failure specification in grounding, it pertained to the human operator as depicted in figure 29 above. An accident moves into the final evacuation phase to protect lives and grounding is the only accident category that has led to evacuations. Accident categories of fire and flooding have not entered this phase.

4.2.2.4 GROUNDING CATEGORY ‘PHASE 3’ OVERVIEW The final ‘phase 3’ pertains to evacuation in an accident situation. In phase 1 and 2 system health is required to be evaluated to initiate appropriate emergency actions. However, in phase 3, emergency response and actions take precedence over the evaluation of system health

Figure 30: Grounding ‘phase 3’ overview (L1-2) Source: Student, based on taxonomy

Emergency Response & Evacuation Action System Health Indication

Call SAR Services

Call Tug Vessel 4, 29% OOW 14% 15% Other 10, 71% 14% 14% Other 14% 29% Contain Hull Damage Drop Anchor

Muster Personnel

System Health Detection System Health Analysis

43% Master 57% Master Other 100%

In an emergency situation arising out of grounding, several measures can be initiated like mustering personnel, calling SAR services, tugs, attempting to contain hull damage, dropping anchor etc. System health is usually indicated by the personnel on the scene like the OOW. It is brought to the attention of senior personnel, the Master and in all the grounding cases system analysis is carried out by the Master.

In levels 3-4 of phase 3 taxonomy, aspects are checked for their applicability and success.

Figure 31: Grounding ‘phase 3’ overview (L3-4) Source: Student, based on taxonomy

System Health Indication System Health Detection 8 8 7 7 6 6 5 5 4 4 7 7 7 7 7 3 3 2 2 1 0 1 0 Information Information Recording Transmission Information Information Information Applicable? Applicable? Receiving Evaluation Transmission Applicable? Applicable? Applicable?

System Health Analysis Emergency Response & Evacuation Action 8 8 7 7 6 6 5 5 4 4 7 7 7 7 7 7 3 3 2 2 1 1 0 0 Information Planning Decision Communication Timing & Selection & Receiving Applicable? Applicable? Applicable? Sequence Quality Applicable? Applicable? Applicable?

Legend Applicable & Successful

In level 3-4 of phase 3 taxonomy in grounding, in each of the 77 times, the applicable aspect has been successful, pointing towards success in post-accident observable aspects and actions. As no aspect has been applicable and unsuccessful, the coding stops at this point. At this stage, no equipment or human failure is noted and phase 3 of grounding accidents have led to successful evacuations with no loss of lives.

4.2.3 FIRE CATEGORY OVERVIEW In this sub-section the findings related to the fire accident category are presented. A total of 8 accident investigation reports were coded under this category, of which 7

resulted in a mitigated loss and 1 resulted in a severe loss of the vessel. None of the fire accidents entered phase 3 – evacuation phase of the accident. Major accidents in this category are due to engine room fires, especially auxiliary engine or main engine fires. Most of the fires were caused by fuel oil leaks due to loose connections or equipment failure. Personnel immediately concerned with fire accidents were the OOW and the engineer officer on duty and motorman, among others. The accidents have largely occurred due to a failure to comply with standard good engineering practice and a failure to comply with equipment/manufacturer’s guidelines.

4.2.3.1 FIRE CATEGORY ‘PHASE 0’ OVERVIEW The HFACS coding for both human operators and equipment (tables 17 and 18) is provided on pages 64 and 65 for this category.

Figure 32: Fire ‘phase 0’ HFACS operator overview; Source: Student

Organisational Influences (i) Supervision (ii)

10% Captain 8% Captain 8% 10% 1st/Chief Officer 1st/Chief Officer 37% 29% 16% 2nd Officer 22% 2nd Officer 10% 13% Other Officer 7% 6% Other Officer 2% AB 2% AB 5% 6% 5% 4% OS OS

Preconditions (iii) Unsafe Acts (iv) Captain Captain 1st/Chief Officer 2% 1st/Chief Officer 10% 14% 17% 2% 2nd Officer 17% 20% 2nd Officer 12% Other Officer 10% 10% Other Officer 30% AB 20% 14% AB 7% OS 3% 6% OS 1st/Chief Engineer 1% 5% 1st/Chief Engineer 2nd Engineer 2nd Engineer

Figure 33: Fire ‘phase 0’ HFACS equipment overview; Source: Student

Supervision (ii) Organisational Influences (i)

33% 45% 33% Main Engine Main Engine 67% Auxiliary Engine Other 22% Other

Preconditions (iii)

Main Engine 44% 17% 22% Auxiliary Engine 17% Fuel Pumps Other

Figures 32 and 33 above, depict the HFACS categories for operators and equipment respectively. Noteworthy in figure 32 is that the HFACS categories of ‘organisational influences’ and ‘supervision’ impact the captain most, however in ‘preconditions’, the captain is preceded by the chief engineer, who is in-charge of the engine room. Under ‘unsafe acts’, the captain and chief engineer are equally identified.

The auxiliary engines and the main engine are critical equipment and they are impacted along with fuel pumps by the HFACS categories of ‘supervision’, ‘organisational influences’ and ‘preconditions’.

Table 17: Fire accident category ‘phase 0’ HFACS operator overview; Source: Student according to taxonomy Operator Break Down L1 Sub-Category L2 Sub-Sub-Category L3 C CO 2O OO AB OS CE 2E OE Total 4 1 1 4 2 1 5 4 4 26 Lack of Human Resources Resource Poor Equipment/Facility 2 0 0 0 0 0 1 0 0 3 Management Resources Disorganised Structure 0 0 0 0 0 0 1 0 0 1

Organisational Inadequate Policies 2 0 0 0 0 0 1 0 0 3 Climate Poor Work Culture 9 2 2 4 2 1 4 3 4 31 Organisational Inappropriate Procedures 4 0 0 2 0 0 2 0 1 9 Process Lack of Oversight 5 1 0 1 0 0 0 0 0 7 Poor 1 0 0 0 0 0 0 0 0 1 International/National Standards Inadequate Flag State 5 0 0 0 0 0 0 0 0 5

Organisational Influences (i) Influences Organisational Statutory Factors Implementation Category Total 86 Inadequate Poor Shipborne and Shore 8 0 1 1 3 2 9 3 1 28 Supervision Supervision Planned 7 2 0 4 1 2 6 3 3 28 Inappropriate Poor Shipborne Operations Operations Failed to Correct Shipborne Related 9 3 0 3 1 1 6 2 1 26 Known Problems Shortcomings 6 1 1 3 2 1 2 3 3 22 Supervisory

Supervision (ii) Supervision Violations Shipborne Violations Category Total 104

Poor Physical Environment 0 0 0 0 0 0 4 0 1 5 Environmental Poor Technological 3 0 0 2 1 1 4 1 1 13 Factors Environment Crew Condition Negative Cognitive Factors 4 1 1 2 3 2 7 3 5 28 Poor Crew Interaction 3 0 0 3 0 0 5 0 1 12 4 1 1 3 2 2 5 4 4 26

Preconditions (iii) Preconditions Personnel Factors Poor Personal Readiness Category Total 74 Skill-based errors 4 2 0 3 1 0 4 2 5 21

Decision and judgement 5 2 1 2 1 1 4 2 5 23 errors Errors Perceptual errors 0 0 0 0 0 0 1 0 0 1 Violations Routine 6 4 1 6 2 0 6 4 3 32 Category Total 77

Unsafe Acts (iv) Acts Unsafe Total 91 20 9 43 21 14 77 34 42 351 Operator: C-Captain; CO-Chief Officer; 2O-2nd Officer; OO-Other Officer; AB-Able Seaman; OS-Ordinary Seaman; CE- Chief Engineer; 2E-2nd Engineer; OE-Other Engineer

Schröder-Hinrichs et al. (2010) analysed engine room space fires for reporting deficiencies pertaining to organisational factors. The researchers found organisational factors were underrepresented, which could in part be due to the investigator applying the stopping rule early or there could be a difficulty in understanding and applying IMO guidelines on casualty investigation. In their research, unsafe supervision accounted for 3.8% of the coded items (p. 1190), while in this dissertation, supervision accounts for 30% (104/351) in fire accident category and organisational influences account for 24.5% as against their 3.8%.

Table 18: Fire accident category ‘phase 0’ HFACS equipment overview; Source: Student according to taxonomy Equipment Breakdown L1 Sub-Category L2 Sub-Sub-Category L3 ME AE FO PUMP Other Total Resource Management Poor Equipment/Facility Resources 2 3 0 4 9 Organisational Climate Poor Work Culture 1 0 0 2 3 Inappropriate Procedures 2 1 0 0 3 Organisational Process Lack of Oversight 1 0 0 0 1 Poor International/National 0 0 0 1 1 Statutory Factors Standards 0 0 0 1 1 Inadequate Flag State

Organisational Influences Influences Organisational Statutory Factors Implementation Poor Shipborne and Shore 1 0 0 0 1

Inadequate Supervision Supervision Planned Inappropriate 1 0 0 0 1 Operations Poor Shipborne Operations Failed to Correct Known 0 0 0 1 1

Supervision Supervision Problems Shipborne Related Shortcomings

0 2 0 0 2 Poor Physical Environment Environmental Factors Poor Technological Environment 3 2 3 6 14 0 0 0 1 1 onditions onditions Crew Condition Negative Cognitive Factors 0 0 0 1 1 Prec Personnel Factors Poor Personal Readiness 11 8 3 17 39 Total Equipment: ME-Main Engine; AE-Auxiliary Engine; FO Pump-Fuel Oil Pump

4.2.3.2 FIRE CATEGORY ‘PHASE 1’ OVERVIEW In ‘phase 1’ of the fire, the indication of the threat is given by the equipment (CCTV, alarms etc.) and human operators. The threat is largely detected by personnel on watch keeping duty, who also analyse the threat and initiate threat mitigation action.

Figure 34: Fire ‘phase 1’ overview (L1-2); Source: Student, based on taxonomy

Threat Indication Threat Detection 7% 7% 7% CCTV & Cameras Fire Alarm System 29% 14% 21% Other OOW/EOW OOW/EOW 86% 29% Other Other Other Crew Member

Threat Analysis 7% 14% Master OOW/EOW 79% No Threat Analysis

Threat Prevention Action

Close fire doors 7% 22% Cut off oxygen supply 50% to flammable area Other 7% 14% Shut down engine No Threat Prevention Action

Threat mitigation actions in this phase usually include closing fire doors, cutting oxygen supply to the area and shutting down engines among others.

Figure 35: Fire ‘phase 1’ overview (L3-4) Source: Student, based on taxonomy

Threat Indication Threat Detection 15 15 1 4 3 10 10 14 14 13 5 5 10 11 0 0 Information Information Information Information Information Recording Transmission Receiving Evaluation Transmission Applicable? Applicable? Applicable? Applicable? Applicable?

Threat Analysis Threat Prevention Action 15 15 0 1 2 4 2 10 6 6 10 9 12 5 12 5 8 8 10 4 0 0 0 Information Planning Decision Communication Timing & Selection & Receiving Applicable? Making Applicable? Sequence Quality Applicable? Applicable? Applicable? Applicable?

Legend Applicable & Successful Applicable & Unsuccessful Not applicable

‘Phase 1’ level 3-4, codes information related aspects, planning, decision making and action and identifies if they were successful or not. According to the analysis, 104 times an aspect was applicable and successful while 47 times an applicable aspect was unsuccessful. ‘Phase 1’ level attributes the failure to human or equipment (see figure 36 on page 69).

Figure 36: Fire ‘phase 1’ overview (L4-5) Source: Student, based on taxonomy

Threat Indication Threat Detection 16 5 14 4 12 10 3 8 14 14 2 4 6 3 4 1 2 1 0 0 Information Information Information Information Recording Information Receiving Evaluation Transmission Applicable? Transmission Applicable? Applicable? Applicable? Applicable?

Threat Analysis 7 6 5 4 3 6 6 2 1 2 0 Information Planning Decision Making Receiving Applicable? Applicable? Applicable?

Legend Human failure, specify

In phase 1, in each of the 47 instances, the failure was attributable to human operators. Lack of success in phase 1, moves an accident into the next accident phase in which the system health has to be evaluated after the accident has taken place.

4.2.3.3 FIRE CATEGORY ‘PHASE 2’ OVERVIEW

Figure 37: Fire ‘phase 2’ overview (L1-2); Source: Student, based on taxonomy

System Health Indication

2% 3% CCTV & Cameras

11% 8% Fire Alarm System 10% Heat Detector 5% 23% Other 11% Smoke Detector OOW/EOW 27% Other Other Crew Member Passenger System Health Detection System Health Analysis 3%

47% Master 26% Master 50% OOW OOW Other 68% 6% Other

Emergency Response Action

Close fire doors 2% 2% Cut off oxygen supply to 5% 11% 8% flammable area 3% Fire-fighting 16% Muster Crew 11% Other 42% Shut down affected systems Shut down engine

Sprinkler System

In phase 2 (L1-2), once the fire has taken place, the system health is detected by various on-board equipment like the fire alarms, heat detector, smoke detector, CCTV and cameras. However it is noteworthy that the system health indication is largely attributed to the human operators on duty, which are the officer of the watch and the engineer officer on watch, who also detect system health. Unlike phase 1 which is the beginning phase of the accident, in phase 2 the incident has progressed. While in phase 1, the threat analysis was largely conducted by the officers on site, in phase 2 the threat analysis is predominantly carried out by the master and a host of emergency response actions are carried out. Level 3-4 analyse the applicability and success and failure of aspects of information (recording, transmission, receiving, and evaluation), planning and decision and emergency response action.

Figure 38: Fire ‘phase 2’ overview (L3-4); Source: Student, based on taxonomy System Health Indication System Health Detection

70 62.5

60 62 50 61.5 1 40 61 30 62 62 2 60.5 62 20 10 60 61 0 59.5 60 Information Information 59 Recording Transmission Information Information Information Applicable? Applicable? Receiving Evaluation Transmission Applicable? Applicable? Applicable? System Health Analysis 70 Emergency Response Action 64 1 1 1 62 60 2 12 50 22 60 5 5 58 40 60 56 57 57 30 60 54 49 20 39 Information Planning Decision Receiving Applicable? Applicable? 10

Applicable? 0 Communication Timing & Selection & Applicable? Sequence Quality Applicable? Applicable? Legend Applicable & Successful; Applicable & Unsuccessful; Not applicable

Figure 38 shows that in 50 instances an aspect was applicable and unsuccessful and there were a total of 629 instances when an aspect was applicable and successful.

Figure 39: Fire ‘phase 2’ overview (L4-5); Source: Student, based on taxonomy

System Health Detection System Health Analysis 2.5 6 2 5 1.5 4 1 2 3 5 5 2 0.5 1 1 2 0 Information Information Information 0 Receiving Evaluation Transmission Information Planning Decision Applicable? Applicable? Applicable? Receiving Applicable? Applicable? Applicable?

Emergency Response Action 25 1 20

15 1 10 21

5 11

0 1 Communication Timing & Selection & Applicable? Sequence Quality Applicable? Applicable?

Legend Human error, specify Equipment error, specify

In level 4-5 of ‘phase 2’ of the fire accident category, the failures of the preceding level are specified to equipment or the human operator. In this phase of the fire accident out of a total of 50 failures, 2 are attributable to equipment failure and 48 to human operators.

Although all of the vessels in the fire accident category were in compliance with SOLAS equipment and certification requirements, however a number of times these certificates have been issued without adequate verification and by cutting the corners with respect to the safety checks. For e.g. Queen Mary 2, Harmonic Filters were not tested during Continuous Survey of Machinery (CSM) surveys as required and failure of this impacted the accident after almost two months (MAIB, 2011, p. 32). In the case of M.V. Calypso, CO2 system was not tested as required and CO2 failed to release during engine room fire. On investigation it was found that even the procedure posted on-board were incorrect. Majority of the fire accidents on-board were due to the fuel oil leakage in Auxiliary engines or Main engine. Which was largely due to the failure to comply with standard good engineering practices during routine and non-routine maintenance work. An aspect was the failure to comply with equipment / manufacturers guidelines when overhauling or replacing / refitting the damaged parts or leaking pipes. This also highlights inadequate training trends for engineers who failed to refer to equipment manual during inspection and investigation of leaks or failed to consult senior engineers in case of doubt, for e.g. M.V. Azamara Quest (MSI, 2013, p. 14, p. 22). Inadequate Formal Safety Assessment (FSA) also impacted the accident, for e.g. Queen Mary 2, in which the Hi Fog system was fitted in compartments containing the high voltage system.

All of the fire accidents finished in stage two due to good response from duty engineers, officers of the watch as well as due to modern automatic firefighting equipment on some ships which contributed positively. However at times due to lack of training or a failure to understand the equipment / system limitations have resulted in failure to contain the fire, for e.g. M.V. Carnival Splendor accident report (USCG, 2013, p. 6), where OOW performed a general reset on the fire detection system and by doing so, the Hi-Fog system failed to activate automatically as it was designed to avoid time delay. This initial mitigation measure could have contained the fire from spreading, provided the OOW was aware of the system limitation.

4.3 OVERVIEW OF THE RESULTS OF ALL 3 CATEGORIES – FLOODING, GROUNDING AND FIRE This section combines the results obtained from all three accident categories and provides an overview of the findings. Table 19: All accident categories ‘phase 0’ (HFACS) operator overview; Source: Student based on taxonomy Total Operator Break Down L1 Sub-Category L2 Sub-Sub-Category L3 C CO 2O OO AB OS H P CE 2E OE Total Lack of Human 11 5 2 5 2 1 0 1 5 4 4 40 Resources Poor Technological 2 2 Resources Resource Poor Equipment / 2 0 0 0 0 0 1 0 0 3 Management Facility Resources Disorganised Structure 2 1 0 0 0 0 1 0 0 4 Organisational Inadequate Policies 3 0 0 0 0 0 1 0 0 4 Climate Poor Work Culture 18 7 4 7 2 1 1 3 4 3 4 54 Poorly Designed 9 1 10 Operation

Inappropriate 7 7 Procedure Organisational Inappropriate 4 0 0 2 0 0 2 0 1 9 Procedures Process Lack of Oversight 6 1 0 1 0 0 0 0 0 8 Poor 4 0 0 0 0 0 0 0 0 4 International/National Standards

nisational Influences (i) Influences nisational Inadequate Flag State 6 0 0 0 0 0 0 0 0 6

Orga Statutory Factors Implementation Category Total 151

Inadequate Poor Shipborne and 18 3 3 3 3 2 9 3 1 45 Supervision Shore Supervision Planned 21 9 3 7 1 2 3 6 3 4 59

Inappropriate Poor Shipborne Operations Operations Failed to Correct Shipborne Related 17 7 2 3 1 1 2 6 2 1 42 Known Problems Shortcomings Supervisory 19 5 3 6 2 1 2 3 3 44

Supervision (ii) Supervision Violations Shipborne Violations Category Total 190 Poor Physical 1 0 0 0 0 0 4 0 1 6 Environment Environmental Poor Technological 8 0 3 3 1 1 1 4 1 1 23

Factors Environment Negative Cognitive 15 3 4 7 3 2 1 7 3 6 51 Factors Crew Condition Poor Physiological State 3 3 Poor Crew Interaction 9 4 1 4 0 0 2 2 5 0 1 28 12 4 2 4 2 2 2 5 4 4 41 Preconditions (iii) Preconditions Personnel Factors Poor Personal Readiness Category Total 152 Skill-based errors 21 5 2 7 1 0 1 3 4 2 5 51 Decision and judgement 16 3 2 2 1 1 4 2 5 36

errors Errors Perceptual errors 0 0 0 0 0 0 1 0 0 1 Routine 20 9 5 10 2 0 1 1 6 4 3 61 Violations Exceptional 4 1 1 1 7 Category Total 156

Unsafe Acts (iv) Acts Unsafe Total 258 67 38 71 21 14 7 18 77 34 44 649 Operator: C-Captain; 2O-2nd Officer; OO-Other Officer; AB-Able Seaman; OS-Ordinary Seaman; H-Helmsman; P-Pilot; CE-Chief Engineer; 2E-2nd Engineer; OE-Other Engineer

Table 19 on the preceding page provides an overview of all the 15 passenger ship accidents coded for the dissertation under the ‘phase 0’ HFACS adapted taxonomy. A total of 649 items were coded, of which a third were coded under the supervision category (190, 30%), followed by unsafe acts (156, 24%), preconditions (152, 23%) and organisational influences (151, 23%).

Figure 40: All accident categories ‘phase 0’ HFACS category overview Source: Student

200 190

180 156 160 151 152 140 120 100

80 60 40 20 0 Organisational Supervision Preconditions Unsafe Acts Influences

All the subcategories under supervision – inadequate supervision, planned inappropriate operations, failed to correct known problems and supervisory violations were coded highly. Under organisational influences, the category of poor work culture was coded 54 times, which is a cause for concern. Under the category of preconditions, negative cognitive factors were coded 51 times and under the category of unsafe acts, skill based errors were coded 51 times and routine violations 61 times. Poor work culture will be discussed further in chapter 6.

The captain was coded 258 times out of 649 (40%), followed by the chief engineer (12%), other officer (11%) and chief officer (10%).

Table 20: All accident categories ‘phase 0’ (HFACS) equipment overview Source: Student based on taxonomy Total Equipment Breakdown 1 Sub-Category L2 Sub-Sub-Category L3 ME AE FO PUMP Other Navigation Aids (AIS, Steering ECDIS, Radar, GPS, etc.) Equipment Total Resource Poor Technology Resource 2 1 3 Management Poor Equipment/Facility 2 3 0 4 1 10 Resources Disorganized Structure 1 1 2 Inadequate Policies Organisational Climate Poor Work Culture 1 0 0 4 1 6 1 1 Poorly Designed Operation Inappropriate Procedures 2 1 0 2 5 Organisational Process Lack of Oversight 1 0 0 0 1 Poor International / 0 0 0 1 1 Statutory Factors National Standards Inadequate Flag State 0 0 0 1 1

Organisational Influences (i) Influences Organisational Statutory Factors Implementation Organisational Influences Category Total: 30 Inadequate Poor Shipborne and Shore 1 0 0 0 1 Supervision Supervision Planned Inappropriate Poor Shipborne 1 0 0 0 1 2 Operations Operations 1 1 Supervisory Violations Shipborne Violations Failed to Correct Shipborne Related 0 0 0 1 1

Supervision (ii) Supervision Known Problems Shortcomings Supervision Category Total: 5

0 2 0 1 1 4 Poor Physical Environment Poor Technological 3 2 3 8 1 1 18 Environmental Factors Environment 0 0 0 2 2

Crew Condition Negative Cognitive Factors

Preconditions Preconditions (iii) Personnel Factors Poor Personal Readiness 0 0 0 1 1 Preconditions Category Total: 25 11 8 3 29 3 6 60 Total

A total of 60 items were coded in the ‘phase 0’ HFACS coding for technical subjects (equipment). Organisational influences were coded the highest (30, 50%), followed by preconditions (25, 41%) and supervision (5, 9%). Under organisational influences, attention needs to be paid to the subcategory of poor equipment/facility resources which was coded 10 times (17%). Under preconditions, sub-sub category of poor technological environment received a high coding of 18 (30%) which would further need to be evaluated.

Among the equipment, the main engine (11, 18%) and the auxiliary engines (8, 13%) received a high coding. A high 50% of equipment coded available under the ‘other’ equipment category. The raw data pertaining to the other equipment would be used to expand the SEMOMAP taxonomy.

Table 21 on the following page provides an overview of all three accident categories in all the three phases for taxonomy level 3-4 and 4-5 evaluation. The table shows that the fire accident category went into two phases and the bulk of the effort is concentrated in ‘phase 2’. The table also shows that the flooding accident finished within ‘phase 1’ itself.

Table 21: All accident categories, all phases, level 3-4 and 4-5 evaluation; Source: Student N Nature of Phase Stages Number of Number of process fail/safe status Failure o Accident Subjects events source Safe Fail Not Human Equipment Applicable Failure Failure 1 Fire Phase-1 Threat Indication 6 28 28 0 0 0 0 Threat Detection 2 42 34 8 0 8 0 Threat Analysis 3 42 28 14 0 14 0 Threat Prevention Action 5 42 14 25 3 25 0 Phase-2 System Health Indication 9 124 124 0 0 0 0 System Health Detection 3 186 183 3 0 3 0 System Health Analysis 3 186 174 12 0 12 0 Emergency Response Action 9 186 148 35 3 33 2 Phase-3 Emergency Response & Evacuation Action 0 System Health Indication 0 System Health Detection 0 System Health Analysis 0 2 Flooding Phase-1 Threat Indication 1 2 2 0 0 0 0 Threat Detection 1 3 3 0 0 0 0 Threat Analysis 1 3 3 0 0 0 0 Threat Prevention Action 1 3 3 0 0 0 0 Phase-2 System Health Indication 0 System Health Detection 0 System Health Analysis 0 Emergency Response Action 0 Phase-3 Emergency Response & Evacuation Action 0 System Health Indication 0 System Health Detection 0 System Health Analysis 0

3 Grounding Phase-1 Threat Indication 6 20 11 3 6 3 0 Threat Detection 3 30 9 9 12 9 0 Threat Analysis 2 30 4 9 17 9 0 Threat Prevention Action 2 33 5 10 18 10 0 Phase-2 System Health Indication 5 36 32 2 2 2 0 System Health Detection 3 54 53 0 1 0 0 System Health Analysis 3 54 42 11 1 11 0 Emergency Response Action 3 60 43 17 0 17 0 Phase-3 Emergency Response & Evacuation Action 6 21 21 0 0 0 0 System Health Indication 2 14 14 0 0 0 0 System Health Detection 2 21 21 0 0 0 0 System Health Analysis 1 21 21 0 0 0 0

The grounding accident category in table 21 above shows that the accident entered into the third phase of evacuation and the bulk of efforts were concentrated in ‘phase 2’.

Table 22 on the following page presents an overview of each time a human operator was applicable and successful or unsuccessful and each time an equipment was applicable and successful or unsuccessful.

Table 22: All accident categories, all phases, level 3-4 and 4-5 evaluation Source: Student

Category Phase Human operator Equipment Total Applicable Applicable Successful Unsuccessful Successful Unsuccessful Flooding Phase 1 11 11 Fire Phase 1 104 47 151 Phase 2 629 48 2 679 Grounding Phase 1 29 31 60 Phase 2 170 30 200 Phase 3 77 77 Total 1020 156 2 1178

Table 22 shows that the equipment only failed 2 times when applicable and the human operator failed 156 times (13%) and succeeded 1020 times (87%). Timing is crucial in on-board accident situations. The success of the human operators in phase 1 of the flooding incident averted a more serious accident and the successes of the human operators in ‘phase 2’ of the fire accident category prevented the fire accidents from going further into the next evacuation accident phase. Failure in a phase leads the accident to progress to the next subsequent phase, however the analysis shows that the recovery from accidents is creditable to the successes of human operators (Reason, 2008).

Table 23: Timelines: all accident categories across all phases Source: Student Category Vessel Name Phase 1 Phase 2 Phase 3 Flooding M.V. Saga Sapphire 00H 02M 00S -- -- Total 2 Min Fire M.V. Azamara Quest 00H 03M 00S 00H 01M 29S -- M.V. Carnival Spirit ------M.V. Carnival 00H 02M 00S 09H 13M 00S -- Splendor RMS Queen Mary 2 00H 36M 00S 00H 24M 00S -- M.V. Royal Princess 00H 00M 45S 04H 32M 00S -- M.V. Star Princess 00H 19M 00S 01H 27M 00S -- M.V. The Calypso NA 00H 38M 00S -- M.V. Zenith 00H 20 M 00S 01H 28M 00S -- Total 80 Min 45 Sec 17 Hr 43 Min Average time 13 Min 2 Hr 31 Min Grounding M.V. Lauren L 01H 17M 00S Not mentioned Not mentioned M.V. Clipper 00H 32 M 00S Not mentioned Not mentioned Adventure M.V. Deutschland 00H 06M 15S 00H 08M 37S -- M.V. Van Gogh 00H 02M 00S 00H 03M 00S -- M.V. Astor 00H 04M 00S 00H 03M 00S -- M.V. Monarch of the 00H 03M 00S 01 H 05 M 00S 02H 55M Seas Total 2 H 4 M 15 S 1 H 19 M 37 S 2 H 53 M Average time 20 Min 20 Min 2 H 53 M

Table 23 depicts the timelines applicable to all phases across all accidents. It can be seen that the time in phase 1 for the flooding accident category was only two minutes and the accident did not progress further. In the fire accident category, the bulk of the efforts were concentrated in phase 2 with an average of 2 hours and 31 minutes and the accident not progress to the evacuation phase. In the grounding accident category,

phase 1 and 2 took an average of 20 minutes each. It is noteworthy that the average of the grounding accident category for phase 2 is distorted as one vessel, M.V. Monarch of the Seas had a high phase 2 timeline of one hour and five minutes which affected the average. Going by the other three vessels that have provided timelines for grounding (M.V. Deutschland, M.V. Van Gogh and M.V. Astor), the phase 2 timeline in grounding accidents is between 3 and 8 minutes. M.V. Monarch of the Seas moved into phase 3 of evacuation and therefore spend considerable time in both phases 2 and 3. The other two vessels that evacuated passengers (M.V. Lauren L and M.V. Clipped Adventurer), did not mention timelines for phases 2 and 3 and therefore the timeline analysis is incomplete. It is to be noted that the timeline analysis is not robust as all of the accident investigation reports had not mentioned clear timelines. This analysis is indicative of the insights one can gain if standardised reporting procedures include timelines in the reports.

4.4 SUMMARY This chapter has presented the findings of the dissertation across all accident categories, phases and taxonomy levels according to the SEMOMAP accident investigation model and its complementary taxonomy. The following chapter reflects on the findings.

5 DISSERTATION REFLECTIONS This chapter reflects upon the findings of the dissertation and discusses how the research questions have been answered in the dissertation.

5.1 REFLECTION ON SEMOMAP SEMOMAP as a maritime accident investigation model has tremendous potential. It is extremely useful to consider the accident process to reveal insights that could help us ultimately to learn from accidents and prevent them from recurring in the future. SEMOMAP is a robust model that incorporates both HFACS and TRACEr taxonomies, allowing for the identification of factors impinging on the accident situation removed in time. However, worthwhile to note here is that the analysis utilising SEMOMAP is largely dependent on the quality of the accident investigation report, which will be discussed further in this chapter

The SEMOMAP taxonomy can be further expanded to be more comprehensive and specific. It could include other ranks on-board to make it more specific. In case of passenger ships they have other staff which is not reflected in the taxonomy (e.g. Staff Captain, Customer service, Safety officer, Staff Chief Engineer, Hotel Staff, etc.). In the electronic database platform created in MaRiSa, WMU to facilitate SEMOMAP coding, ‘other’ additional human operators are not included in the category as it accepts the first entry. This can be resolved to be more specific about the ‘other’ human operators involved.

Muster passengers and muster crew should be depicted separately in the taxonomy as these are two different actions most of the times and occur at different time intervals. Under communication, the urgency message / distress message can be included in the

taxonomy. The critical equipment list can be expanded to be more exclusive as most of the time these are involved in the accident (quick closing valves, harmonic filters, etc.).

The taxonomy could consider including MAIB, NTSB, USCG etc. under the investigating authorities. Analysis of the report depends upon the quality of the investigation report as well as the investigator and assessor, as many reports may be investigated by a technical expert who has none or limited in depth training on Human element or factors. So he/she is likely to miss out key human element or human factors issues which may have contributed to the accident or incident. Therefore it is imperative to follow a uniform standard for accident investigation where all aspects are covered / approached with equal importance. It is worth noting that investigation reports conducted by USCG and ATSB are much more comprehensive than other reports which were conducted by some flag states. When analysing these reports one gets a much broader and clearer picture about the various contributory factors. A research on various investigating bodies and a comparison of their findings itself will be highly valuable and can contribute positively in drawing future guidelines for accident investigation of the IMO.

The NTSB is an independent governmental agency charged with determining the probable cause of transportation accidents and promoting transportation safety in the United States, whereas in some other states it may not be the same and they might not be in a position to conduct similar independent investigations due to lack of freedom.

For further validation of SEMOMAP, professional researchers from different spectrum of the industry must be considered (operational, academics, inspectors etc.). They should be given similar case studies for the analysis and the outcome must be compared for further improvement and amendment. This will help in making the model more robust to meet diverse complex requirements.

5.2 REFLECTION ON RESULTS AND RESEARCH QUESTIONS All the research questions, the student had identified in the beginning of the dissertation have been adequately answered in the preceding chapters. This section provides a reflection on them.

 Is the maritime industry specific SEMOMAP suitable to explore maritime accidents? This research question has been answered adequately in chapter 4 on the analysis of accident investigation reports. The model has undergone comprehensive testing and evaluation in the analysis of 15 accident investigation reports and has served the student well by not being generic but rather specific to the maritime domain with a nuanced understanding of its language, personnel, operations, equipment and shipboard and shore based dimensions.

 What is it about the unique unfolding of the accident process on board and the shipboard behaviours and barriers, if any, that can lead to different accident outcomes for different accidents. The time of reaction to a developing dangerous situation and corresponding evaluation of applicable and successful/unsuccessful aspects leads to different outcomes for different vessels. The majority of the fire accidents were the result of inadequate investigation of the underlying causes by the responsible engineers and failure to comply with standard procedures. This occurred despite frequent break down and parameter alarms (e.g. M.V. Carnival Splendor (USCG, 2013)) where auxiliary engine frequently tripped due to overload and torsional vibration alarm from the equipment. In another case of M.V. Azamara Quest (MSI, 2013), the auxiliary engine was made to run on load directly after the repair was performed for fuel oil leakage and without conducting any test run as necessary to ensure that the repair was successful.

Accident investigation with a focus on the involved processes and actions reveals unique insights into on-board work culture. The case of M.V. Azamara Quest, highlights that the accident could have been completely averted in ‘phase 1’ itself if the motor man who had detected the fuel oil leak had the authority to tackle it locally. He reported the risk to the second engineer on the VHF who came down to confirm the source of the leak and assess the situation and then decided to stop the generator remotely from the control room instead of locally taking care of the risk. This costly time delay resulted in a full- fledged fire incident which resulted in a severe loss to the vessel. This aspect highlights among others, the lack of authority of the lower ranked motor man to deal with issues locally; the complacency of the second engineer which resulted in loss of time and poor decision of the second engineer to remotely turn off the generator. This is especially more important when given the fact that most of the fire accidents were caused due to fuel oil leakage. Any leakage from critical equipment with hot surfaces around, should be dealt with, without any time delay. However, in some cases where vigilant crew responded swiftly, they managed to contain the fire and loss was mitigated. This highlights that good practices and additional barriers on-board can certainly help in mitigating loss.

 What are the common processes in emergency situations on-board in case of fire, grounding and flooding? In majority of the cases they followed the routine SMS procedures for the particular emergency, however at times failed to comply with the same which could be due to lack of training and/or complacency, among other factors. In case of flooding no claims can be made about common processes as only one accident was analysed under the category. In fire it is noteworthy that in all accidents the first phase is relatively short and if the threat is not detected and mitigated swiftly, it develops quickly into an accident and enters ‘phase 2’. It is noteworthy that in most firefighting accidents, ‘phase 2’ is long as the bulk

of the firefighting efforts are concentrated in this phase. In the grounding accident category, most of the accidents have a short phase 1 and a short phase 2. It can be safely assumed that they would then have a longer phase 3 as that would involve evacuation.

 How much time is available to recover from an emergency situation during the different phases of the accident?

The majority of the accident investigation reports do not provide a very good time line and therefore it is difficult to make claims related to time analysis. However this is a potential aspect that SEMOMAP allows to be evaluated.

 How realistic is the time limit of 30 minutes required for abandoning ship, post breach of threshold.

All three vessels that conducted evacuations only did it for the passengers and no timelines are provided for crew transfer. M.V. Monarch of the Seas had 2557 passengers and 831 Crew members, M.V. Clipper Adventurer 128 passengers and 69 Crew members on-board and M.V. Lauren L had only 38 passengers and the number of crew member was not mentioned in the report. They remained on-board for further duration.

o M.V. Clipper Adventurer The grounding incident occurred on 27th Aug at 1832 Lt and all passengers were mustered at 1910 Lt, which is almost after 38 minutes delay and since the vessel was firmly aground; after assessing the situation, passengers were asked to stand down at approximately 2030 Lt. The total number of passengers on- board at the time of the incident was 128 and 69 crew. The passengers were transferred to another vessel on the 29th August at 1000 Lt.

Although the passengers were transferred safely from all ships however the time taken to transfer them was not clearly defined and certainly it was much more than the 30 minutes time window as required by the IMO.

One of the observations made during this analysis is that during most of these emergencies, the passengers were not updated and mustered immediately after the accident. This can lead to a dangerous situation as it is difficult to hide an impact or blackout on-board. Waiting till the last minute, keeping the passengers uninformed can cause panic and uncertainty. Therefore, it is recommended that whenever there is an accident on-board, it is imperative to muster the crew and passengers without delay, and continue system assessments as appropriate. In case the situation is not so serious the passengers and crew can be stood down later on. o M.V. Monarch of the Seas The grounding incident occurred on 15th December at 0130 Lt and all the passengers were mustered at 0148 Lt. The portside lifeboats were lowered at 0210 and STBD side at 0215. However after assessing the damage the master decided to ground the vessel intentionally at 0235 Lt this was done to minimise the chances of flooding and foundering. Since vessel was close to the port the master decided to use tenders for transferring passengers from the ship to shore. At 0245 first tender came alongside and at 0519 they completed the passenger disembarkation operation. The operation took around 02h 34m which is much more than the IMO’s limit of 30 minutes and this is when the vessel was resting on the reef. The total number of passengers on-board at the time of incident was 2557 and 831 crew members. o M.V. Lauren L M.V. Lauren L had only 38 passengers and the number of crew members number was not mentioned in the report. They remained on-board for further

duration. The timeline for the transfer operation is also not mentioned in the report.

With a limited number of evacuation incidents, it is difficult to confirm the validity of the IMO’s time requirement, however, in the above accidents it certainly took much more time to evacuate the passengers as compared to the 30 minute time limit. Delay in mustering the passengers is a major cause for concern and this approach highlights the lack of training and standardised procedures in such an emergency. This needs to be highlighted further to create mandatory procedures to ensure that passengers are informed and mustered without delay in case of an incident or accident on-board.

5.3 SUMMARY Reports from NTSB, USCG, MAIB and BSU covered the investigation in depth whereas some other administration and investigating agency reports were shallow without adequate timeline or further information. A majority of the accidents were attributed to human error and SEMOMAP has the strength to investigate how humans mitigate accidents on-board. Accident investigation reports should include the positive human contribution and support SEMOMAP in studying this aspect. In some cases the reports have highlighted the need of further training etc., but unfortunately these accidents were found to be recurring on ships supposedly manned by well-trained officers and crew. The question is, are we looking in the right direction? If so, why are we unable to minimize these accidents? And what needs to be improved so that we can get positive results on a global level?

SEMOMAP is a step in the right direction with respect to maritime accident investigation and should be utilised to study accident cases to reveal comprehensive insights into accident processes and what action we might recommend at which stage to stop the situation from escalating further.

6 CONCLUSIONS The SEMOMAP model and its accompanying taxonomy are robust for the purpose of maritime accident investigation. Most of the accidents analysed in this dissertation highlight a lack of inadequate risk assessment and non-compliance with SMS in line with the ISM code. The results revealed among other issues, a poor work culture on- board and negative cognitive attitudes. It is important to sensitise the shipping industry and academic community to HFACS aspects in connection with on-board accident processes which can be analysed with SEMOMAP. This can help us to understand recovery from accident situations and help us to learn in detail about accident processes, in addition to the other factors impacting the accidents.

Given the dissertation findings, effective implementation of rules and regulations like the ISM code is essential for increasing overall safety and reducing risk on-board ships2. The theme for the 2014 World Maritime day is the effective implementation of IMO conventions (IMO, 2014b). Mandatory compliance is required with the ISM with the introduction of chapter IX into SOLAS - “Management for the Safe Operation of Ships”. The ISM code links the flag, the owner and the vessel and requires a customized SMS tailored to suit the company needs to improve on-board safety (Baldwin and Cave, 1999).

Regarding the ISM code, Bhattacharya (2012a, p. 528) found ‘a wide gap between its intended purpose and practice’. The researcher found a lack of seafarers’ participation and the underlying causal factors were located in poor employment conditions and low trust relationships.

2 A previous version on the implementation of the ISM code has been submitted by the student for MSEA 253, Maritime Human Element assignment.

Learning from incidents on board is essential to enhance shipboard safety. The self- regulatory nature of the ISM code requires for shipboard incidents to be reported, investigated and analyzed (Bhattacharya, 2012b, p. 4). Batalden & Sydnes (2014) found that the main challenges pertained to four sections of the ISM code: Section 5 – Master’s responsibility; Section 6 – resources and personnel; Section 7 – development of plans for shipboard operation and Section 12 – company, verification, review and evaluation. The findings of the HFACS coding of this dissertation are in a similar direction and need to be addressed to contribute to the on-board safety culture.

The ISM code has contributed to safety (Heijari and Tapaninen, 2010) and should be effectively implemented to reap the benefits. There is a link between the organizational safety climate and employee safety compliance which leads to increased employee participation and reduction in accidents (Clarke, 2006). Management of shipboard safety requires building and sustaining a safety culture on board (Havold, 2010, Ek et al., 2014). Company and on-board implementation of the ISM code should address the safety of shipping by taking into account the human element (Hetherington et al., 2006).

Appendix 1: Detail list of accident investigation reports No Ship Name IMO No Flag Classification Nature of Narrative and report Source accident 1 M.V. Zenith 8918136 Malta Germanischer Fire On 25 June 2013, at 0335, the fire alarm sounded in the engine-room of the Lloyds Maltese registered passenger ship Zenith. Upon investigation, a fire was noticed on the starboard father main engine. The seat of the fire was between the turbocharger and cylinder head no. 1. Immediate actions were taken by the crew members to contain the fire and ensure the safety of all persons on board. The safety investigation identified that the immediate cause of the fire was the fracture of a low carbon steel pipe on a fuel damping cylinder assembly on the starboard father main engine. This fracture led to the release of gas oil, at a pressure of about 6 bars, which sprayed on an exposed high temperature area of the main engine exhaust gas manifold. The MSIU has issued one recommendation to the Company intended to enhance the vessels maintenance regime vis-à-vis all the critical equipment installed in the machinery spaces.

https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations-2014.aspx 2 M.V. Azamara 9210218 Malta Lloyds’ Fire On 30 March 2012, Azamara Quest departed Manila, Philippines for Quest Register Sandakan, Malaysia as her next planned call on her cruise itinerary. There were 1001 persons on board, i.e. 590 passengers and 411 crew members. At around 2000, a fire broke out on diesel generator no. 4 whilst it was being tested following repairs on a leaking fuel oil return pipe. The prime mover was shut down, and the low pressure water mist firefighting system automatically activated. The fuel oil quick closing valves were closed and the ventilation to the engine-room stopped. Thereafter, at 2006, the vessel suffered a complete blackout as all the other generator engines stopped working. The crew and passengers were mustered and the crew fire parties entered the main engine- room to assess the fire. At about 2043, the staff chief engineer reported that the fire had been extinguished and thereafter, some fire doors and shell doors were subsequently opened to ventilate the heavy smoke out of the affected area. Power to Azamara Quest’s engines was restored in the evening of 31 March and the vessel resumed her passage at slow speed. She entered Sandakan Harbour on 01 April with one crew member in a critical condition as a result of smoke inhalation.

https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations-2012.aspx

3 M.V. Carnival 9188647 Malta Lloyds’ Fire At 1818 (LT) on 30 December 2012, a fire broke out in the women sauna room Spirit Register of the passenger vessel Carnival Spirit, whilst en route from Mystery Island, Vanuatu to Sydney Australia. Automatic fire/heat detection devices activated and alerted the crew. Although the fire was contained inside the sauna room, the fixed water dry sprinkler system did not activate and the fire was extinguished manually. The safety investigation has concluded that the fire was caused by the placement of the women’s sauna wooden cedar floor grate on top of the frame work surrounding the sauna’s heating element/hot stones. An examination of the dry sprinkler pipe and check valve revealed that the latter was blocked in the closed position and did not open due to corrosion/oxidation of the valve seat. The safety investigation has also found that there were no specific maintenance records for the fixed dry sprinkler system in the sauna. In view of the safety actions taken by the ship managers, no recommendations have been made.

https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations-2012.aspx

4 M.V. Carnival 9333163 Panama Lloyds’ Fire On November 8, 2010 at 0600 (Local Time), the Carnival Splendor was Splendor Register underway off the coast of Mexico when the vessel suffered a major mechanical failure in the number five diesel generator. As a result, engine components, lube oil and fuel were ejected through the engine casing and caused a fire at the deck plate level between generators five and six in the aft engine room which eventually ignited the cable runs overhead. The fire in the cable runs was relatively small, but produced a significant volume of smoke which hampered efforts to locate and extinguish it. In addition, the fire caused extensive damage to the cables in the aft engine room, which contributed to the loss of power. Post casualty analysis of the event revealed that the installed Hi-Fog system for local protection was activated 15 minutes after the initial fire started. This delay was the result of a bridge watch stander resetting the fire alarm panel on the bridge. This was a critical error which allowed the fire to spread to the overhead cables and eventually caused the loss of power. While the fire was eventually self-extinguished, the failure of the installed CO2 system and the poor execution of the firefighting plan contributed to the ineffectiveness of the crew’s firefighting effort.

https://homeport.uscg.mil/mycg/portal/ep/contentView.do?channelId=- 18374&contentId=460088&programId=21431&programPage=%2Fep%2Fpro gram%2Feditorial.jsp&pageTypeId=13489&contentType=EDITORIAL

5 RMS Queen 9241061 United Lloyds’ Fire At 0425 on 23 September 2010, as RMS Queen Mary 2 (QM2) was Mary 2 Kingdom Register approaching Barcelona, an explosion occurred in the vessel’s aft main switchboard room. Within a few seconds, all four propulsion motors shut down, and the vessel blacked out shortly afterwards. Fortunately, the vessel was clear of navigational hazards and drifted in open sea. The emergency generator started automatically and provided essential supplies to the vessel, and it was quickly established that the explosion had taken place in the aft harmonic filter (HF) room, situated within the aft main switchboard. The aft main switchboard was isolated, main generators were restarted and the ship was able to resume passage at 0523, subsequently berthing in Barcelona at about 0900. No one was injured. The accident caused extensive damage to the aft HF and surrounding structure. Two water-mist fire suppression spray heads were activated, one in the aft harmonic filter room and the other in the aft main switchboard room. The explosion was triggered by deterioration in the capacitors in the aft HF. Internal arcing between the capacitor plates developed, which vaporised the dielectric medium causing the internal pressure to increase, until it caused the capacitor casing to rupture. Dielectric fluid vapour sprayed out, igniting and creating the likely conditions for an arc- flash to occur between the 11000 volt bus bars that fed power to the aft HF. A current imbalance detection system, which was the only means to warn against capacitor deterioration, was found to be inoperable, and it was evident that it had not worked for several years.

http://www.maib.gov.uk/cms_resources.cfm?file=/QM2Report.pdf 6 M.V. Royal 9210220 Bermuda NA Fire In the evening of 18th of June 2009, a few minutes before 20:00 hours Royal Princess Princess departed from Port Said, Egypt having spent the day alongside there as a planned call on her cruise itinerary. On board were 733 passengers and a crew of 393 giving total number of persons on board of 1126. As the vessel passed between the breakwaters leaving Port Said a fire broke out on diesel generator No4. This unit and unit No. 2 were both in operation providing power for the ship. A number of alarm conditions alerted the automation system of a pending loss of power from No.4 and diesel generator No.1 started automatically and took up the electrical load in conjunction with No. 2. Propulsion was maintained and the Captain made for the first available anchorage. Crew fire parties were mustered and an attempt was made to enter the engine room but the team were beaten back by smoke and heat. Passengers were called to muster stations and looked after there by the passenger services teams. A decision to tackle the fire with the CO2 total flooding system was quickly made and as soon as the vessel was in a position

to anchor the engine room was sealed, machinery stopped and CO2 injected. Boundary cooling was maintained where necessary and temperatures were seen to reduce quite quickly after the CO2 injection. Passengers were held at muster stations until just after midnight when they were allowed more freedom to access open decks in view of the heat in muster stations in June in Egypt with no air conditioning and limited ventilation. At about 0041 hours an entry was made to the engine room which confirmed that the fire was extinguished and shortly afterwards passengers were allowed to return to their cabins to rest.

http://www.bermudashipping.bm

7 M.V. Star 9192363 Bermuda RINA Fire At 0309 (UTC+5) on 23 March 2006, a fire was detected on board the cruise Princess ship Star Princess. The ship was on passage from Grand Cayman to Montego Bay, Jamaica, with 2690 passengers and 1123 crew on board. The fire was investigated by the Marine Accident Investigation Branch (MAIB) on behalf of the Bermuda Maritime Administration, in co-operation with the United States Coast Guard (USCG), and the United States’ National Transportation Safety Board (NTSB). The fire started on an external stateroom balcony sited on deck 10 in the centre of main vertical zone 3, on the vessel’s port side. It was probably caused by a discarded cigarette end heating combustible materials on a balcony, which smoldered for about 20 minutes before flames developed. Once established, the fire spread rapidly along adjacent balconies and, assisted by a strong wind over the deck, it spread up to decks 11 &12 and onto stateroom balconies in fire zones 3 and 4 within 6 minutes. After a further 24 minutes, it had spread to zone 5. The fire also spread into the staterooms as the heat of the fire shattered the glass in stateroom balcony doors, but was contained by each stateroom’s fixed fire-smothering system, the restricted combustibility of their contents, and their thermal boundaries. As the fire progressed, large amounts of dense black smoke were generated from the combustible materials on the balconies, and the balcony partitions. This smoke entered the adjacent staterooms and alleyways, and hampered the evacuation of the passengers, particularly on deck 12. One passenger died as a result of smoke inhalation, and 13 others were treated for the effects of the smoke.

http://www.maib.gov.uk/cms_resources.cfm?file=/star%20princess.pdf

8 M.V. The NA Cyprus Lloyds’ Fire At 0330 ship’s time on 6 May 2006, the Cypriot registered cruise ship The Calypso Register Calypso suffered an engine room fire while on passage from Tilbury to St.

Peter Port, Guernsey, with 708 passengers and crew on board. Initial action by the watch keeping engineer officer was effective in eventually extinguishing the fire although the vessel lost all but emergency electrical power and was left drifting in the south-west lane of the Dover Straits Traffic Separation Scheme (TSS), 16 miles south of Beachy Head. The vessel’s starboard main engine had been very seriously damaged and she was towed to the port of Southampton by the Maritime and Coastguard Agency’s (MCA) emergency towing vessel Anglian Monarch.

http://www.maib.gov.uk/publications/investigation_reports/2007/calypso.cfm? view=print& 9 M.V. Saga 7822457 Malta Germanischer Flooding On 06 January 2013, at 0050 (UTC), Saga Sapphire experienced a flooding in Sapphire Lloyds a number of forward compartments during a ballast operation, while in the English Channel on passage from El Ferrol to Southampton. The flooding effected deck no. 6 forward (Hotel Store Compartment), deck no. 5 forward (Hotel Carpenters’ Workshop Area) and the bow thruster space. The flooding, which reduced the vessel’s GM height by 34 cm, was discovered at 0038 (UTC) during a fire patrol. The ingress of water also damaged the bow thruster motor. There were no reported injuries or pollution. The direct cause of the flooding was a crack, which developed in the vent / overflow pipe during the ballasting of deep tank no. 1, which was being conducted without adequate supervision. The safety investigation also found less than adequate watch handover procedures. Moreover, the rubber seal of the watertight cover to the bow thruster flat was damaged. As a result of the safety investigation, the MSIU has issued one recommendation aimed to enhance the vessel’s safe ballast operations.

https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations-2014.aspx 10 M.V. Lauren L 9246827 Malta Germanischer Grounding On 01 April 2012, at 1318 (LT), the passenger vessel Lauren L sailed from La Lloyds Digue to Praslin in Seychelles. The intention was to seek a sheltered anchorage on the north-west side of Praslin, where it would have been possible to land the passengers with the vessel’s tenders onto an appropriate beach. After transiting the Baie Curieuse Channel, Lauren L headed west past the northern coast of Praslin. Approaching the planned anchoring position on a roughly south westerly heading, the vessel ran aground at 1435 on a rock pinnacle charted as an isolated danger at a depth of 1.7 m. Lauren L was refloated at 1820. An inspection revealed that the damage was confined to the bow thruster compartment and in way of the grey water tank. The safety investigation concluded that bridge navigational equipment, in particular the

ECDIS, was not utilised to its full potential. There were also shortcomings in the bridge team composition. MSIU has issued three recommendations to the company designed to address the navigational procedures and practices on board and the use of VDR data.

https://mti.gov.mt/en/Pages/MSIU/Safety-Investigations-2013.aspx 11 M.V. Clipper NA Bahamas NA Grounding Upon departure from Port Epworth, the Clipper Adventurer followed the Adventure planned course along a single line of soundings at 13.9 knots. The chief officer who was in charge of the watch monitored the vessel’s progress using parallel indexing on the starboard radar and monitored the water depth on the echo- sounder. The master monitored the portside radar when on the bridge. Once clear of Port Epworth and on course 300°gyro, the vessel was placed on autopilot and proceeded at 13.9 12F12F 13 knots. The quartermaster remained on the bridge, to take over the steering when required. Shortly after departing Port Epworth, the chief officer marked a depth of 66 m on the chart in an area near where the chart indicated a depth of 40 m. At 1832, the vessel ran aground on a shoal in position 67°58.2' N and 112°40.3' W and listed 5 ° to port. The vessel grounded on hard rock shelf from approximately the forepeak to amidships. This was a previously reported shoal not marked on the chart in use.

http://www.tsb.gc.ca/eng/rapports- reports/marine/2010/m10h0006/m10h0006.asp 12 M.V. 9141807 Germany Germanischer Grounding The passenger ship DEUTSCHLAND was on a cruise through the group of Deutschland Lloyds islands off southern Chile and reached the Italia Glacier in the northern arm of the Beagle Channel on Sunday 15 January 2012 at about 2300. The master, an officer on watch, a helmsman and a pilot were on the bridge. A few minutes before reaching the glacier, the ship’s command asked the pilot if it would be acceptable to sail closer to the glacier than planned so as to provide passengers with the best possible view of this area. The pilot responded with a decision to reduce the speed and sail much closer to the glacier. The DEUTSCHLAND grounded on her starboard side as she was turning back towards the middle of the fjord two cables away from the coastline. The engine was stopped immediately and instructions to establish the damage to the ship were given. It was possible to move the ship back in the direction of the middle of the fjord by means of various engine and helm manoeuvres a short time later and continue the voyage to the next port. Damage to the ship or environment was not found.

http://www.bsu-bund.de 13 M.V. Van 7359400 Marshall Det Norske Grounding At about 1817 on 23 February 2008, the Marshall Islands registered passenger Gogh Island Veritas ship Van Gogh grounded briefly on the western shore of the Mersey River during a departure from Devonport, Tasmania. The ship was under the conduct of a harbour pilot who had taken over the conduct from the master about five minutes before, after the master had manoeuvred the ship off the berth. As the ship left the berth, it began to be set towards the bulk carrier Goliath berthed ahead. Van Gogh was under the influence of the ebb tide and fresh water that was flowing from the Mersey River’s catchment following heavy rain in the area in the previous 24 hours. Van Gogh was difficult to manoeuvre at low speed because of its twin propellers and single rudder configuration. This, combined with the strong ebb tide and fresh water outflow in the river at the time of departure, resulted in there being insufficient water flow over its rudder to enable the pilot to manoeuvre the ship as he intended. In addition, the master did not inform the pilot that the crew would be using the ship’s engines independently during turns in the river. This resulted in the pilot being concerned that his orders were being countermanded because he saw that the engine telegraph levers were not as he had ordered. Following the grounding, the pilot successfully manoeuvred the ship back into the channel and the ship departed the port without further incident. There was no damage to the ship and no pollution resulted. The report identifies a number of safety issues and acknowledges the safety actions which have been taken by Club Cruise International and the Tasmanian Ports Corporation to address them.

http://www.atsb.gov.au/publications/investigation_reports/2008/mair/pdf/mair 252_001.pdf 14 M.V. Astor 8506373 Bahamas Germanischer Grounding At 1900 on 26 February 2004, the Bahamas registered passenger ship Astor Lloyds let go its mooring lines and departed the Queensland port of Townsville. The ship, equipped with twin rudders, controllable pitch main propellers and a single bow thruster, did not require a tug for the departure. The master, as is common practice on passenger ships, manoeuvred the ship clear of the berth and then, even though this was his first visit to Townsville, kept the conduct of the ship without consulting the harbour pilot. The pilot adopted an advisory role. As the ship was turning from the harbour into Platypus Channel, part of the approach channel to the port, it grounded on its port side. The ship heeled three degrees to starboard and, after about three minutes, slid clear of the bank without assistance and continued out of the channel.

http://www.atsb.gov.au/publications/investigation_reports/2004/mair/mair200. aspx 15 M.V. Monarch 8819500 Norway Det Norske Grounding At approximately 0030 hours on the night of 15 December 1998, the passenger of the Seas Veritas vessel MONARCH OF THE SEAS arrived outside of Great Bay, St. Maarten in order to evacuate a sick passenger to a shore side medical facility. At 0125 the vessel’s crew completed the passenger evacuation evolution and the MONARCH OF THE SEAS departed St. Maarten, taking a South- Southeasterly departure route with the intention of safely passing to the east of the Proselyte reef obstruction. At approximately 0130 hours the MONARCH OF THE SEAS raked the Proselyte Reef at an approximate speed of about 12 knots without becoming permanently stranded. Almost immediately emergency and abandon ship signals were sounded and the crew and passengers were mustered at their abandon ship stations. At 0235 the vessel was intentionally grounded on a sandbar in Great Bay, St. Maarten. By 0515 hours all 2,557 passengers were safely evacuated ashore by shore based tender vessels.

http://marinecasualty.com/documents/monarch.pdf

100

Appendix 2: SEMOMAP code book SEMOMAP Draft Codebook

1. Overview of SEMOMAP

SEMOMAP is a primarily sequential accident investigation model developed for the maritime industry. The original framework, developed by Schröder (2003) as a part of his PhD thesis, is shown below:

detection

Organisational

Failure

Technical

Human

failure failure

failure

Dangerous situation

yes

Beginningaccident

assessmt

Situation

Dangerous

situation

yes

response

Initial

yes

recovered

System

yes

Near miss

assessment

System

Further

input

data

Safe

recovery

possible

System

shipboard

Accident

yes

operational

Abandonship

response actions

externalsupport

Preparation

Emergency

evacuation

Callingfor

status

recovered

System

yes

Release

system

Emergency

Evacuation

Monitoring

evacuation

External

support support

delay

Stop

recovery

external

Total loss Mitigated loss

Fig. 1 – The ‘Original’ SEMOMAP model

The idea behind this original model was that an accident can be depicted via a series of sequential steps and crucial phases. Building on this idea, a revamped SEMOMAP model – SEMOMAP v2 – was developed, as shown in Fig. 2 on the following page.

101

102

Fig. 2 – The revamped SEMOMAP model – SEMOMAP v2

Before beginning the analysis of an accident through SEMOMAP, some general data needs to be collated. The taxonomy of the information that needs to be gathered is provided in section 2; it consists of fields such as the ship name, IMO Number, and type and severity of incident. The information collected via this taxonomy can allow users to compare how accidents differ (if at all), based on factors such as type of ship, type of incident, and ship size. If the right data and information is available, users can also do further analyses – such a comparing the safety records of ships classified by different class societies or that of ships having different flag states.

Having collected some basic background information, one can then use the SEMOMAP model. The ‘new’ SEMOMAP v2 consists of 4 different phases. The ‘first’ phase is called ‘Phase 0’. This phase identifies all the ‘Contributory Factors’ that contributed indirectly in a way that led to a risk of an accident happening – but did not contribute to the accident itself. In other words, the factors described in this phase led to the creation of a dangerous situation, but did not directly cause any consequences per se. The taxonomy for ‘Phase 0’ is adapted from HFACS – the Human Factors Analysis & Classification System, and was originally used for a paper published by Schröder-Hinrichs, et al. (2011) titled ‘Accident investigation reporting deficiencies related to organizational factors in machinery space fires and explosions’. The taxonomy for phase 0 is presented in section 3 of this codebook. A person using SEMOMAP identifies various subjects (human and technical) from the accident report, and then using the HFACS taxonomy, describes factors that influenced that subject and contributed to the creation of a dangerous situation.

If the factors mentioned in ‘Phase 0’ are resolved in time, the vessel can return to normal operation; if this is not the case however, the accident progresses to the next 3 phases of SEMOMAP. The second, third, and fourth phases of SEMOMAP are called ‘Phase 1’, ‘Phase 2’, and ‘Phase 3’ respectively.

‘Phase 1’ is the ‘Beginning Accident’ phase. At this point, the subjects in the system – and by extension, the system itself – have been affected by the factors identified in ‘Phase 0’. This means that the system is facing an imminent risk of an incident, but still, the accident itself has not come to pass. ‘Phase 1’ could indicate, for example, a vessel turning on to collision or grounding route due to some factors as identified in ‘Phase 0’ – but would not cover the collision or grounding itself. At this stage then, there is still a possibility to avoid the accident through correct threat indication, detection, analysis, and correct threat prevention action. If the correct steps are followed, the vessel can return to safe operations, with the incident classed as a ‘near-miss’.

If however, the situation remains unchanged, the timeline moves into ‘Phase 2’ – i.e. – ‘The Accident’ phase. As the name implies, this phase starts the moment the vessel experiences an accident. At this stage, there is a possibility to prevent the accident from escalating any further, through appropriate system health indication, detection, analysis, and appropriate

103

emergency response measures. If the appropriate measures are undertaken, depending on the severity, the vessel can either suffer a ‘mitigated loss’ or a ‘severe loss’. Mitigated loss would indicate that the vessel has suffered damage, but can port unassisted; a severe loss indicates a large enough damage that the ship cannot port unassisted.

If, by the end of Phase 2, the damage is not contained, it is possible that the situation escalates further into the very last, critical phase – ‘Phase 3’ – a.k.a. – ‘Evacuation’. In this phase, as the name implies, the best course of action is to evacuate and abandon the vessel. However, emergency response measures may also continue to fight for increased evacuation time. In this phase the priority is on the emergency and evacuations actions; system health indication, detection and analysis may also continue to monitor the developments.

All 3 latter phases – Phases 1, 2, and 3 – have 4 types of steps: an ‘indication’ step, a ‘detection’ step, an ‘analysis’ step, and an ‘action’ step. These steps and their ‘common’ taxonomies are discussed further in section 4. Each step has multiple ‘levels’ of information that can be filled in, to provide more details that describe the accident. The taxonomies of these ‘levels’ are also discussed in section 4.

The four types of steps, as shown for ‘Phase 2’ of SEMOMAP

Fig. 3 – The steps of SEMOMAP

The reader may also note that it is possible to ‘loop around’ or have ‘iterations’, as shown in Fig. 2. In each ‘loop’ or ‘iteration’ there can only be one (or none) ‘indication’, ‘detection’, and ‘analysis’ – but more than one ‘action’ is possible. Each phase, can of course, have multiple iterations. It is also possible for an iteration to change the actual type of accident, or risk of accident that a vessel faces.

This is because maritime accidents can be very complex, and a risk or an accident of one type can quickly evolve into another type. In fact, according to Vassalos (2009), the following possible links are possible between different types of accidents:

104

Fig. 4 – Possible accident evolutions. Source: Vassalos (2009)

2. Taxonomy for General Information

Taxonomy Category Description IMO Number State the IMO number of the ship Vessel Name State ship name and its previous name Vessel type Classify the type of ship by its functionality to carry its cargo: GC, Container, Bulk Carrier, Tanker, Passenger, Ro- Ro, Others Vessel Flag State State ship flag at the time of the accident Classification Society State the class society the ship was classified under at the time of the accident Keel Laid Year State the keel laid year as indicated in ship certificate Built at State the location (shipyard, country) the ship built Deadweight Ton (DWT) DWT of the ship Ship Length Over All (m) Overall length of the ship Ship Beam (m) State ship breadth Ship Loaded Draft (m) State the ship draft at the time of the occurrence Ship Height (m) state the vertical measure of ship bottom to the upmost deck Date of Occurrence State date of occurrence Time of Occurrence State time of occurrence by Local time and GMT Geographical Occurrence State the location of the occurrence by its fix gps position Location and other geographical reference Type of Occurrence Classify nature of accident with following event: Collision, Grounding, Contact, Fire/explosion, Hull failure, Loss of control, Ship/equipment damage, Capsize/listing, Flooding/foundering, Ship Missing, Occupational accident, Others, Unknown Number of Fatalities / State number of the fatalities as a result of the accident at Injuries the point and subsequent fatality, Consequence to the Ship Provide sufficient information of the end consequences to the ship due to accident, Narratives Brief overview of the occurrence

105

3. Taxonomy for Phase 0

As mentioned earlier, the taxonomy for Phase 0 was adapted from HFACS. This section breaks down the HFACS taxonomy, and provides descriptions of what each option. The taxonomy used for SEMOMAP consists of 4 levels; for brevity, however, the taxonomy definitions provided in the codebook are only for levels 1, 2 and 3.

Organisational Influence

Resource Organisational Organisational Statutory factor Management Climate Process

Supervision

Inadequate Planned Inappropriate Failed to Correct Supervisory Supervision Operations Known Problems Violations

Preconditions

Environmental Crew Condition Personnel Factors Factors

Unsafe Acts

Errors Violations

106

Level-1 Taxonomy

Terminology Definition Organisational factors in a mishap if the communications, actions, omissions or Influence policies of upper-level management directly or indirectly affect supervisory practices, conditions or actions of the operator(s) and result in system failure, human error or an unsafe situation Supervision a mishap event can often be traced back to the supervisory chain of command. Pre-Condition factors in a mishap if active and/or latent preconditions such as conditions of the operators, environmental or personnel factors affect practices, conditions or actions of individuals and result in human error or an unsafe situation Unsafe Acts

107

Level-2 Taxonomy

Taxonomy under Organisational influence

Organisational Influence

Resource Organisational Organisational Statutory factor Management Climate Process

Parent Level L-2 Terminology Definition Organisational Resource factor in a mishap if resource management and/or Influence Management acquisition processes or policies, directly or indirectly, influence system safety and results in poor error management or creates an unsafe situation Organisational Factor in a mishap if organizational variables Climate including environment, structure, policies, and culture influence individual actions and results in human error or an unsafe situation. Organisational Factor in a mishap if organizational processes such as Process operations, procedures, operational risk management and oversight negatively influence individual, supervisory, and/or organizational performance and results in unrecognized hazards and/or uncontrolled risk and leads to human error or an unsafe situation Statutory factors Considered as external factor that mostly on the policy and regulatory side

108

Taxonomy under supervision

Supervision

Inadequate Planned Inappropriate Failed to Correct Supervisory Supervision Operations Known Problems Violations

Parent Level L-2 Terminology Definition Supervision Inadequate factor in a mishap when supervision proves supervision inappropriate or improper and fails to identify a hazard, recognize and control risk, provide guidance, training and/or oversight and results in human error or an unsafe situation Planned factor in a mishap when supervision fails to inappropriate adequately assess the hazards associated with an operation operation and allows for unnecessary risk. It is also a factor when supervision allows non-proficient or inexperienced personnel to attempt missions beyond their capability or when crew or flight makeup is inappropriate for the task or mission. Failure in factor in a mishap when supervision fails to correct correct known known deficiencies in documents, processes or problem procedures, or fails to correct inappropriate or unsafe actions of individuals, and this lack of supervisory action creates an unsafe situation. Supervisory factor in a mishap when supervision, while managing violation organizational assets, wilfully disregards instructions, guidance, rules, or operating instructions and this lack of supervisory responsibility creates an unsafe situation.

109

Taxonomy under Precondition

Preconditions

Environmental Crew Condition Personnel Factors Factors

Parent Level Terminology Definition Pre Condition Condition of Factors in a mishap if cognitive, psycho-behavioural, Individual adverse physical state, or physical/mental limitations affect practices, conditions or actions of individuals and result in human error or an unsafe situation. Environmental factors in a mishap if physical or technological factors Factor affect practices, conditions and actions of individual and result in human error or an unsafe situation Personal Factor factors in a mishap if self-imposed stressors or crew resource management affects practices, conditions or actions of individuals, and result in human error or an unsafe situation

110

Taxonomy under Unsafe Acts

Unsafe Acts

Errors Violations

Parent Level Terminology Definition Unsafe Acts Errors Factors in a mishap when mental or physical activities of the operator fail to achieve their intended outcome as a result of skill-based, perceptual, or judgment and decision making errors, leading to an unsafe situation Violations Factors in a mishap when the actions of the operator represent wilful disregard for rules and instructions and lead to an unsafe situation. Unlike errors, violations are deliberate.

111

Level-3 Taxonomy

Taxonomy under Resource Management (under Organisational Influence)

Resource Management

Poor Equipment/ Poor Technological Poor Equipment/ Facility Resources Resources Facility Resources

 Inadequate safe  Excessive cost cutting  Engineer support manning  Financial resources/  Acquisition policies/  Selection support design process  Training  Attrition policies  Accession/ selection policies  Poor engine-room design  Poor engine-room machinery design  Purchasing of unsuitable equipment  Failure to correct known design flaws  Shortage of tools

Parent Level Terminology Definition Resource Lack of human Issues that directly influence safety include Management resource selection (including background checks), training, and staffing/manning Poor technological Are factors in a mishap when ship design resources factors or automation affect the actions of individuals and result in human error or an unsafe situation Poor issues related to equipment design, including equipment/facility the purchasing of unsuitable equipment, inadequate design of workspaces, and failures to correct known design flaws

112

Taxonomy under Organisational Climate (under Organisational Influence)

Organisational Climate

Disorganised Struct ure Policies Poor Work Culture

 Chain-of-command  Promot ion  Norms and rules  Communication  Hiring, firing and  Organisational  Accessibility/ visibilit y retention customs, beliefs and of supervisor  Drugs and alcohol attitudes  Delegation of  Accident and incident  Safety as a value authority/ rigidity investigation  Formal accountability for actions

Parent Level L-3: Terminology Definition organizational Disorganised a factor when the chain of command of an climate Structure individual or structure of an organization is confusing, non-standard or inadequate and this creates an unsafe situation Inadequate A course or method of action that guides present Policies and future decisions. Policies may refer to hiring and firing, promotion, retention, raises, sick leave, drugs and alcohol, overtime, accident investigations, use of safety, equipment, etc. When these policies are ill-defined, adversarial, or conflicting, safety may be reduced Poor Work a factor when explicit/implicit actions, statements Culture or attitudes of unit leadership set unit/organizational values (culture) that allow an environment where unsafe mission demands or pressures exist

113

Taxonomy under Organisational Process (under Organisational Influence)

Organisational Process

Poorly Designed Inappropriate Lack of Oversight Operation Procedures

 Operational tempo/  Performance  Doctrine workload standards  Established safety  Incentives  Clearly defined programmes/ risk  Time pressure objectives management  Schedules  Procedural guidance/ programmes publications  Monitoring and  Informational checking of resources/ support resources, climate and processes to ensure safe work environment

Parent Level L-3: Terminology Definition Organisational Poorly designed a factor when the potential risks of a large program, Process operation operation, acquisition or process are not adequately assessed and this inadequacy leads to an unsafe situation. Inappropriate a factor when written direction, checklists, graphic procedures depictions, tables, charts or other published guidance is inadequate, misleading or inappropriate and this creates an unsafe situation Lack of oversight a factor when programs are implemented without sufficient support, oversight or planning and this leads to an unsafe situation

114

Taxonomy under Statutory Factor (under Organisational Influence)

Statutory factor

Poor International/ Inadequate Flag State National Standards Implementation

 Rule-making process  Link with vessel/  Regulations company  Delegation of authority to RO  Class and statutory surveys  Communication

Parent Level L-3: Terminology Definition Statutory Poor national or international standards that led to poor factor international/national conditions and a dangerous situation standards Inadequate flag state the flag state procedures were inadequate and led implementation to a dangerous situation

115

Taxonomy under Inadequate Supervision (under Supervision)

Inadequate Supervision

 Poor Shipborne and Shore Supervision

 Leadership/ supervision/ oversight inadequate  Supervision - modelling  Local training issues/ programmes  Supervision - policy  Supervision - personality conflict  Supervision - lack of feedback  Failed to provide current public/ adequate technical data or procedures  Failed to provide adequate rest period  Lack of accountability  Perceived lack of authority  Failed to track qualifications  Failed to track performance  Over-tasked/ untrained officer at management level  Loss of supervisory situational awareness  Lack of communication with company representatives

Parent Level L-3: Terminology Definition Inadequate Poor shipborne a factor when the availability, competency, quality or supervision and shore timeliness of leadership, supervision or oversight does supervision not meet task demands and creates an unsafe situation

116

Taxonomy under Planned Inappropriate Operations (under Supervision)

Planned Inappropriate Operations

 Poor Shipborne Operations

 Ordered/led maintenance beyond capability  Poor crew interaction  Limited recent experience  Limited t otal experience  Proficiency  Lack of risk assessment - formal  Authorised unnecessary hazard  Failed to provide adequate brief time / supervision  Failed to provide adequate opportunity for crew rest  Excessive tasking/ loading

Parent Level L-3: Terminology Definition Planned Poor shipborne a factor in a mishap when supervision fails to inappropriate operations adequately assess the hazards associated with an operations operation and allows for unnecessary risk

117

Taxonomy under Failed to Correct Problems (under Supervision)

Failed to Correct Known Problems

 Shipborne Related Shortcomings

 Failed to correct inappropriate/risky behaviour  Failed to correct a safety hazard  Failed to initiate corrective action  Failed to report unsafe tendencies  Failed to update manual  Parts / tools incorrectly labeled

Parent Level L-3: Terminology Definition Failed to Shipborne related a factor when the supervisor selects an individual correct known shortcomings who’s experience for either a specific manoeuvre, problems event or scenario is not sufficiently current to permit safe mission execution.

118

Taxonomy under Supervisory Violations (under Supervision)

Supervisory Violations

 Shipborne Violations

 Engaged unqualified crew  Failed to enforce rules/regs  Violated procedures  Willful disregard of authority  Inadequate documentation

Parent Level L-3: Terminology Definition Supervisory Shipborne Violations on board the ship that led to the creation of violations violations a dangerous situation

119

Taxonomy under Environmental Factors (under Preconditions)

Environmental Factors

Poor Physical Environment Poor Technological Environment

 Temperature - thermal stress  Controls and switches  Artificial light  Automation  Vibration  Machinery space layout  Ship movements and manoeuvres  Communication equipment  Toxins and cleanliness in machinery  Barriers space  Faulty equipment  Noise interference  Constrained tool use  Complex fault  Inaccessible maintenance area  Machinery space configuration variability  Parts unavailable  Parts incorrect ly labeled  Easy to install incorrectly  Machinery space system knowledge  Procedure not understandable  Procedure unavailable/ inaccessible  Incorrect procedure  Too much/ conflicting information  Process/ procedure update not carried out  Incorrectly modified manufacturer's procedures

Parent Level L-3: Terminology Definition Environmental Poor physical Physical environment are factors in a mishap if factors environmental environmental phenomena such as weather, climate, white-out or dust-out conditions affect the actions of individuals and result in human error or an unsafe situation Poor Technological environment are factors in a mishap technological when cockpit/vehicle/workspace design factors or environment automation affect the actions of individuals and result in human error or an unsafe situation

120

Taxonomy under Crew Condition (under Preconditions)

Crew Condition

Negative Cognitive Factors Poor Physiological State

 Inattention, repetitive and monotonous  Effects of PoM and OTC (Medicinal  Channelised attention Drugs)  Confusion  Operational injury/ illness  Distraction  Sudden incapacitation/  Checklist interference unconsciousness  Emotional state  Physical fatigue  Personality style  Seasickness  Overconfidence  Hypoxia  Pressing  Hyperventilation  Complacency  Dehydration  Overagressive  Physical t ask oversaturation  Excessive motivation to succeed  Intoxication  Get-there-itis  Nutrit ion  Response set  Inadequate rest  Burnout  Unreported disqualified medical  Fatigue - mental condition  Circadian rhythm desynchrony  Overexcertion while off duty  Misperception of operational condition  Misplaced motivation  Misinterpreted/ misread instrument  Inadequate mot ivation  Expectancy  Pre-existing physical illness/ injury/  Auditory cues deficient  Other cues  Motor skill/ coordination or timing  Alertness (drowsiness) deficient  Peer pressure  Insufficient reaction time  Technical/procedural knowledge  Negative transfer Parent Level L-3: Terminology Definition Crew Negative Are factors in a mishap if cognitive or attention condition cognitive factors management conditions affect the perception or performance of individuals and result inhuman error or an unsafe situation Poor physiological Are factors when an individual’s personality traits, state psychosocial problems, psychological disorders or inappropriate motivation creates an unsafe situation

121

Taxonomy under Personnel Factors (under Preconditions)

Personnel Factors

Poor Crew Interact ion Poor Personal Readiness

 Machinery space leadership  Inadequate t raining  Cross-monit oring  Maintenance task knowledge performance  Time constraints  Team work delegation  Patt ern of poor risk judgment  Rank gradient/power distance  Assertiveness  Communicating critical information  Challenge and reply  Maintenance plan  Maintenance plan briefing  Task-in-progress re- planning  Miscommunication

Parent Level L-3: Terminology Definition Personnel Poor crew Refer to interactions among individuals, crews, and factors interaction teams involved with the preparation and execution of a mission that resulted in human error or an unsafe situation Poor personal factors in a mishap if the operator demonstrates readiness disregard for rules and instructions that govern the individuals readiness to perform, or exhibits poor judgment when it comes to readiness and results in human error or an unsafe situation

122

Taxonomy under Errors (under Unsafe Acts)

Errors

Skill-based errors Decision and judgement Perceptual errors errors

 Inadvertent use of  Risk assessment during  Error due to equipment, control and operation misperception swit ches  Task misprioritisation  Error due to misjudged  Task overloadFailure t o  Necessary action – parameters see and avoid rushed  Distraction  Necessary action –  Poor techniques/ delayed seamanshipOver/  Warning ignored under-control of the  Wrong decision making system during operation  Over-reliance on automation  Negative habit  Checklist error  Omitted step in procedure  Procedures not used  Failed to priorit ise attention

Parent Level L-3: Terminology Definition Errors Skilled based Are factors in a mishap when errors occur in the errors operator’s execution of a routine, highly practiced task relating to procedure, training or proficiency and result in an unsafe a situation Decision and Are factors in a mishap when behaviour or actions of judgement errors the individual proceed as intended yet the chosen plan proves inadequate to achieve the desired end-state and results in an unsafe situation Perceptual errors Are factors in a mishap when misperception of an object, threat or situation, (such as visual, auditory, pro prioceptive, or vestibular illusions, cognitive or attention failures, etc), results in human error

123

Taxonomy under Violations (under Unsafe Acts)

Violations

Routine Exceptional

 Violation based on risk  Exceeded limits of system assessment  Accepted unnecessary  Inadequate briefing for job hazards  Operated when  Not qualified unauthorised  Unauthorised to operate  Violated training rules beyond design criteria  Failed to comply wit h manuals  Violated standing orders and regs  Failed to inspect after alarm Parent Level L-3: Terminology Definition Violations Routine a factor when a procedure or policy violation is systemic in a unit/setting and not based on a risk assessment for a specific situation. It needlessly commits the individual, team, or crew to an unsafe course-of-action. These violations may have leadership sanction and may not routinely result in disciplinary/administrative action. Habitual violations of a single individual or small group of individuals within a unit can constitute a routine/widespread violation if the violation was not routinely disciplined or was condoned by supervisors Exceptional a factor when an individual, crew or team intentionally violates procedures or policies without cause or need. These violations are unusual or isolated to specific individuals rather than larger groups. There is no evidence of these violations being condoned by leadership

124

‘Taxonomy of Subjects Affected by Contributory Factors

It was mentioned earlier that it is important to identify the subjects that are influenced by the contributory factors. Following is a tabulated list of subjects. Note that this list is by no means exhaustible. Each of the subjects is self-explanatory.

Category of Subject Sub-Category Subject Human Subjects Captain & Officers Captain 1st/Chief Officer 2nd Officer 3rd Officer Other Officer Navigators Helmsman Pilot Other Crew AB Bosun OS Engineers 1st/Chief Engineer 2nd Engineer Other Engineer Technical Subjects Bridge & Deck Steering Equipment Navigation Aids (AIS, ECDIS, Radar, GPS, etc…) Communication Equipment Alarm Panels & System Engine Room Main Engine Auxiliary Engine Engine Control Panel Fuel Pumps Ballast Water Pumps Generators Boilers Ship Structure & Hull Design Separators

125

4. Taxonomy for Phases 1 – 3

Phases 1, 2 and 3, as mentioned earlier, each consist of 4 types of steps. At each step, several levels of information can be filled in – in a given order. The section details the order in which information is filled in, and provides taxonomies for each of the 4 different steps.

126

L5 connections, unreliable software unreliable connections, connections, unreliable software unreliable connections, monitor for threat; forget to share information of threat; omitted action omitted threat; of information toshare forget threat; for monitor action omitted threat; of information toshare forget threat; for monitor settings, electric failure, poor maintenance record, out-of-date technology, loose loose technology, out-of-date record, maintenance poor failure, electric settings, settings, electric failure, poor maintenance record, out-of-date technology, loose loose technology, out-of-date record, maintenance poor failure, electric settings, Choose a problem based on chosen hardware - e.g. not installed, turned off, wrong wrong off, turned installed, not e.g. - hardware chosen on based problem a Choose Mis-hear, mis-see, mis-read threat; ignore threat; late detection of threat; forget to forget threat; of detection late threat; ignore threat; mis-read mis-see, Mis-hear, to forget threat; of detection late threat; ignore threat; mis-read mis-see, Mis-hear, Choose a problem based on chosen Auto. System - e.g. not installed, turned off, wrong wrong off, turned installed, not e.g. - System Auto. chosen on based problem a Choose Phase 1 - Beginning Accident Beginning - 1 Phase L4B No Threat Information Recorded Information Threat No Recorded Information Threat Unclear Recorded Information Threat Partial Recorded Information Threat Wrong Recorded Information Threat in Delay Recorded Information Threat Unnecessary Recorded Information Threat No Recorded Information Threat Unclear Recorded Information Threat Partial Recorded Information Threat Wrong Recorded Information Threat in Delay Recorded Information Threat Unnecessary Transmitted Information Threat No Transmitted Information Threat Unclear Transmitted Information Threat Partial Transmitted Information Threat Wrong Transmitted Information Threat in Delay Transmitted Information Threat Unnecessary Transmitted Information Threat No Transmitted Information Threat Unclear Transmitted Information Threat Partial Transmitted Information Threat Wrong Transmitted Information Threat in Delay Transmitted Information Threat Unnecessary L4A This phase covers how an accident could have been avoided altogether, despite the imminent risk of a dangerous situation dangerous a of risk imminent the despite altogether, avoided been have could accident an how covers phase This Human Failure - Specify - Failure Human Specify - Failure Human

Equipment Failure - Specify - Failure Equipment Specify - Failure Equipment

not:

Information Recording Successful? If not: If Successful? Recording Information

Information Transmission Successful? If If Successful? Transmission Information

L3B

Information Recording Applicable? Recording Information Applicable? Transmission Information

L3A Which specific threat indicator, based on the dangerous scenrio, did not function? function? not did scenrio, dangerous the on based indicator, threat specific Which

L2 Threat Indication Threat L1

127

As shown in the figure on the previous page, filling in a SEMOMAP step during any phase consists of up to 7 stages (shown in black circles, numbered 1 to 7).

1. Determine the Phase

The phases have been discussed previously in Section 1. It is possible to be in Phase 0, 1, 2 or 3. This section deals exclusively with Phases 1, 2 and 3.

2. Determine the Step (Indication, Detection, Analysis or Action) – Level 1

If they are in Phase 1, the steps will be [Threat] Indication, [Threat] Detection, [Threat] Analysis, and [Threat Prevention] Action

In Phase 2, the steps will be [System Health] Indication, [System Health] Detection, [System Health] Analysis, and [Emergency Response] Action

In Phase 3, the steps will be [Emergency Response & Evacuation] Action, [System Health] Indication, [System Health] Detection, and [System Health] Analysis

The steps are self-explanatory. An ‘Indication’ step is one where something may be indicated by someone or something. A ‘detection’ step is where the indication from an indicator may be detected by someone or something. In the ‘analysis’ step, someone or something may performs an analysis on what is detected in the previous step. In the ‘action’ step, an action may be taken based on the ‘analysis’ step. It is important to note that any of these steps, it is possible that nothing is done at all.

3. Choose a Subject – Level 2

Depending on stages 1 and 2, as well as the type of risk, or type of accident that the vessel faces, the users must choose a subject at this stage that was used for a particular step in a particular phase, for a particular type of accident. The type of accident (navigation, on-board, entire-vessel constitutes ‘Level 2A’).

The tables on the following pages show the possible subjects for the various phases, steps, and types of incidents.

128

Possible subjects for Phase 1 under navigational incidents (collision, contact, grounding)

L2B L2C L2D L2E

Radar

Echo Sounder

AIS

Equipment ECDIS

Sea Charts GPS Onboard Other Lookout

OOW Other Crew Human Member

Passenger

Threat Indication Other

Foghorn

Lighthouse

Equipment Bouy/Navigation al Aid Ashore Other VTS Human Coastguard Other

L2B L2C L2D L2E Decision Support Equipment System Other Onboard Master Human OOW Other

Threat Detection Threat VTS Ashore Human Other

129

L2B L2C L2D L2E Decision Support

Equipment System Other Onboard Master Human OOW Other Threat Analysis VTS Ashore Human Other

L2B L2C L2D L2E

Steering & Manouvering Altering Speed Onboard Action Dropping Anchor Reverse Thrust Other Other Vessel Alters Course Offboard Action Other Vessel Alters Speed

Threat Prevention Action Prevention Threat Other

130

Possible subjects for Phase 1 under on-board incidents (fire, explosion, structural failure, engine failure, loss of control, equipment damage)

L2B L2C L2D L2E

Fire Alarm System Heat Detector Equipment Smoke Detector CCTV & Cameras Other

Onboard Lookout OOW/EOW Human Other Crew Member Passenger Other

Threat Indication Fleet Monitoring Equipment System Other Ashore Fleet Monitoring Human Centre Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW/EOW Other Fleet Monitoring Centre Threat Detection Threat Ashore Human Other

131

L2B L2C L2D L2E Decision Support Equipment System Other Onboard Master Human OOW Other Fleet Monitoring Equipment System Threat Analysis Other Ashore Fleet Monitoring Human Centre Other

L2B L2C L2D L2E Cut off oxygen supply to

flammable area Close fire doors

Action Move flammable goods to safe place Onboard Action Reduce heat Shut down engine Shut down affected systems Threat Prevention Threat Other

132

Possible subjects for Phase 1 under entire-vessel incidents (Capsize, Listing, Flooding, Foundering)

L2B L2C L2D L2E

Alarms & Warning Stability Indicators Equipment Water Level Indicators CCTV & Cameras Other Onboard Lookout OOW Human Other Crew Member Passenger

Threat Indication Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre Human Other

L2B L2C L2D L2E

Decision Support System Equipment

Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Threat Detection Threat Ashore Fleet Monitoring Centre Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other

Onboard Master Human OOW

Analysis Other Fleet Monitoring System Equipment

Threat Other Ashore Fleet Monitoring Centre Human Other

133

L2B L2C L2D L2E

Onboard Altering Speed

Stabilize & Secure Cargo Seal Hull Compartments Action

Threat Other

Prevention action Prevention

134

Possible Subjects for Phase 2 under navigational incidents (collision, contact, grounding)

L2B L2C L2D L2E Hull Damage Sensors List Indicators

Equipment Water Level Indicators Stability Indicators Onboard Other OOW Other Crew Member Human Passenger Other Fleet Monitoring System

System Health Indication Health System Equipment Other Ashore Fleet Monitoring Centre Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre

System Health Detection Health System Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other

Health Analysis Health

Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre System Human Other

135

L2B L2C L2D L2E

Contain Hull Damage Contain Equipment Damage Onboard Action Drop Anchor Reverse Thrust

Action Other Tug Vessel

Emergency Response Emergency Offboard Action Other

136

Possible subjects for Phase 2 under on-board incidents (fire, explosion, structural failure, engine failure, loss of control, equipment damage)

L2B L2C L2D L2E Fire Alarm System Heat Detector Equipment Smoke Detector

CCTV & Cameras Other Onboard Lookout OOW/EOW Human Other Crew Member Passenger Other Fleet Monitoring System System Health Indication Health System Equipment Other Ashore Fleet Monitoring Centre Human Other

L2B L2C L2D L2E Decision Support System Equipment

Other Onboard Master Human OOW Other

Detection

System Health Health System Fleet Monitoring Centre Ashore Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre System Health Analysis Health System Human Other

137

L2B L2C L2D L2E Fire-fighting Sprinkler System

Muster Crew Move flammable goods to

Action safe place Cut off oxygen supply to Onboard Action flammable area Close fire doors Shut down engine Shut down affected systems

Emergency Response Emergency Other Fire-fighting vessel Offboard Action Other

138

Possible subjects for Phase 2 under entire-vessel incidents (Capsize, Listing, Flooding, Foundering)

L2B L2C L2D L2E Alarms & Warning Stability Indicators Equipment Water Level Indicators

CCTV & Cameras Other Onboard Lookout OOW Human Other Crew Member Passenger Other

System Health Indication Health System Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre

System Health Detection Health System Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre System Health Analysis Health System Human Other

139

L2B L2C L2D L2E Altering Speed

Stabilize & Secure Cargo Seal Hull Compartments

Onboard Action Seal Watertight Compartments

Action Ballast Water Stabilisation Other

Emergency Response Emergency Tug Vessel Ashore Action Other

140

Possible Subjects for Phase 3 under navigational incidents (collision, contact, grounding)

L2B L2C L2D -L2E

Contain Hull Damage

Contain Equipment Damage Drop Anchor Reverse Thrust Lower Lifeboats Onboard Action Lower MES/Liferafts Muster Personnel Other Emergency Response Measure Other Evacuation Measure Call Tug Vessel

Emergency Response & Evacuation & Response Emergency Offboard Action Call SAR Services Other

L2B L2C L2D L2E

Hull Damage Sensors List Indicators

Equipment Water Level Indicators Stability Indicators Onboard Other

Indication

OOW Other Crew Member Human Passenger Other Fleet Monitoring System

System Health System Equipment Other Ashore Fleet Monitoring Centre Human Other

141

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre

System Health Detection Health System Human Other

L2B L2C L2D L2E

Decision Support System Equipment Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre System Health Analysis Health System Human Other

142

Possible subjects for Phase 3 under on-board incidents (fire, explosion, structural failure, engine failure, loss of control, equipment damage)

L2B L2C L2D L2E

Fire-fighting Sprinkler System Muster Crew Move flammable goods

to safe place Cut off oxygen supply to flammable area Close fire doors Shut down engine Onboard Action Shut down affected systems Lower Lifeboats Lower MES/Liferafts Muster Personnel Other Emergency Response Measure

Emergency Response & Evacuation & Response Emergency Other Evacuation Measure Call Fire-fighting vessel Offboard Action Call SAR Services Other L2B L2C L2D L2E

Fire Alarm System Heat Detector Equipment Smoke Detector CCTV & Cameras

Other Onboard Lookout OOW/EOW Other Crew Human Member Passenger Other Fleet Monitoring System Health Indication Health System Equipment System Other Ashore Fleet Monitoring Human Centre Other

143

L2B L2C L2D L2E

Decision Support Equipment System Other Onboard Master Human OOW Other Fleet Monitoring Ashore Human Centre System Health Detection Health System Other

L2B L2C L2D L2E

Decision Support Equipment System Other Onboard Master Human OOW Other Fleet Monitoring Equipment System Other Ashore System Health Analysis Health System Fleet Monitoring Human Centre Other

144

Possible subjects for Phase 3 under entire-vessel incidents (Capsize, Listing, Flooding, Foundering)

L2B L2C L2D L2E

Altering Speed Stabilize & Secure Cargo

Seal Hull Compartments Seal Watertight Compartments Ballast Water Stabilisation Onboard Action Lower Lifeboats Lower MES/Liferafts Muster Personnel Other Emergency Response Measure Other Evacuation Measure

Emergency Response & Evacuation & Response Emergency Call Tug Vessel Ashore Action Call SAR Services Other

L2B L2C L2D L2E

Alarms & Warning Stability Indicators Equipment Water Level Indicators

CCTV & Cameras Other Onboard Lookout OOW Human Other Crew Member Passenger Other

System Health Indication Health System Fleet Monitoring System Equipment Other Ashore Fleet Monitoring Centre Human Other

145

L2B L2C L2D L2E

Decision Support

Equipment System Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore

System Health Detection Health System Fleet Monitoring Centre Human Other

L2B L2C L2D L2E

Decision Support Equipment System Other Onboard Master Human OOW Other Fleet Monitoring System Equipment Other Ashore System Health Analysis Health System Fleet Monitoring Centre Human Other

146

4. Specify whether the step was Applicable and Successful – Level 3A & 3B

This stage firstly breaks down each step into smaller ‘sub-steps’, as follows:

Step Sub-Steps Indication Information Recording Information Transmission Detection Information Receiving Information Evaluation Information Transmission Analysis Information Receiving Planning Decision Making Action Communication Timing & Sequence Selection & Quality

Once again, these steps and sub-steps are self-explanatory.

At this stage, the user must determine whether each sub-step was applicable or not. If it was not applicable (for instance, if the threat indicator and detector are the same person and there is therefore no transmission or receiving or information; or if there was no threat detection) the user does not need to answer any more questions, and can move to the next sub-step or step. Alternatively, if a sub-step was applicable, and successful, in that case too, the user can move to the next sub-step without going into further stages of the sub-step.

If, however, a sub-step is applicable, and unsuccessful, the user must answer further questions, and moves to stage 5.

Note here that successful means success in the context of the sub-step – and not in the context of the entire accident or incident; a successful action might still be a wrong action in terms of the accident, but it was ‘successful’ because in itself, it was done correctly, but may, for example, have been based on wrong information from the previous step.

5. Specify whether Human or Equipment Failure – Level 4A

If a sub-step was unsuccessful, the user can select in this stage if it was due to human or equipment failure.

6. Specify what the Human or Equipment Failure Was – Level 4B

In this level, the user gets to specify what the exact human or equipment failure was. It depends on the sub-step, and the phase that the user is in. Tables on the following pages show the possible failures for each possible sub-step as defined in earlier on this page. This taxonomy is adapted from the TRACEr taxonomy of Kirwan and Shorrock (2002).

147

Possible Failures for Information Recording

No Information Recorded Unclear Information Recorded Partial Information Recorded Wrong Information Recorded Delay in Information Recorded Unnecessary Information Recorded

Possible Failures for Information Transmission

No Information Transmitted Unclear Information Transmitted Partial Information Transmitted Wrong Information Transmitted Delay in Information Transmitted Unnecessary Information Transmitted

Possible Failures for Information Receiving

No Information Received Unclear Information Received Partial Information Received Wrong Information Received Delay in Information Received Unnecessary Information Received

Possible Failures for Information Evaluation

No Evaluation Unclear Evaluation Partial Evaluation Incorrect Evaluation Delayed Evaluation

Possible Failures for Planning

No Planning Unclear Planning Partial Planning Wrong Planning Delay in Planning Unnecessary Planning

148

Possible Failures for Decision Making

No Decision Unclear Decision Partial Decision Wrong Decision Delay in Decision

Possible Failures for Communication

No Action Information Provided/Recorded Unclear Action Information Provided/Recorded Partial Action Information Provided/Recorded Wrong Action Information Provided/Recorded Delay in Action Information Provided/Recorded Unnecessary Action Information Provided/Recorded

Possible Failures for Timing & Sequence

Action too long Action too short Action too early Action too late Action repeated Action in wrong sequence

Possible Failures for Selection & Quality

Omission Action too much Action too little Action in wrong direction Wrong action on right object Right action on wrong object Wrong action on wrong object Extraneous act

149

7. Specify why the failure occurred – Level 5

In this level, the user gets to specify why the human or equipment made an error or failed. It depends solely on whether a human or technical subject committed a failure, regardless of the phase or the step. The taxonomy for this stage too (at least for the human subjects) is adapted from TRACEr (Kirwan, Shorrock 2002).

The following tables show possible internal error modes for human subjects.

150

151

The following tables show the possible respective psychological error modes, also for human subjects.

152

With regards to equipment failures, there is no ‘taxonomy’ per se. However, it is broadly been identified that an equipment may cause a failure if it is not installed, if it is turned off, is on the wrong settings, suffers from an electric failure, has a poor maintenance record, is out-dated technology, has loose connections or unreliable software. Some of these errors too can be traced back to human mistakes, but primarily may be considered ‘equipment’ failure causes.

153

REFERENCES

AGCS 2014. Safety and Shipping Review 2014 - An annual review of trends an developments in shipping losses and safety. Allianz Global Corporate & Specialty Communication. BALDWIN, R. & CAVE, M. 1999. Understanding regulation: theory, strategy and practice, Oxford, Oxford University. BATALDEN, B.-M. & SYDNES, A. K. 2014. Maritime safety and the ISM code: a study of investigated casualties and incidents. WMU Journal of Maritime Affairs, 13, 3-25. BHATTACHARYA, S. 2012a. The effectiveness of the ISM code: a qualitative enquiry. Marine Policy, 36, 528-35. BHATTACHARYA, S. 2012b. Sociological factors influencing the practice of incident reporting: the case of the shipping industry. Employee Relations, 34, 4-21. CAFFERTY, D. B. M. & BAKER, C. C. 2006. Trending the causes of marine incidents. Presented at the Learning from Marine Incidents 3 Conference. London: ABS Technical Papers. CARIDIS, P. 1999. CASMET: Casualty Analysis Methodology for Maritime Operations. CLARKE, S. 2006. The relationship between safety climate and safety performance: a meta- – analytical review. Journal of Occupational Health Psychology, 11, 315-27. COOKE, M. M. 2007. Ship Fire Safety Design. By Design, 7. EK, A., RUNEFORS, M. & BORELL, J. 2014. Relationships between safety culture aspects – A work process to enable interpretation. Marine Policy, 44, 179 – 186. GHIRXI, K. T. 2010. The stopping rule is no rule at all: Exploring maritime safety investigation as an emergent process within a selection of IMO member states. Malmö: WMU. HAVOLD, J. I. 2010. Safety culture and safety management aboard tankers. Reliability Engineering and System Safety, 95, 511 – 519. HAWKINS, F. H. 1987. Human factors in flight, Aldershot, Gower Technical Press. HEIJARI, J. & TAPANINEN, U. 2010. Efficiency of the ISM code in Finnish shipping companies. Turku: University of Turku. HEINRICH, H. W. 1931. Industrial accident prevention, New York, McGraw-Hill. HEINRICH, H. W. 1980. Industrial accident prevention, (5th Ed). New York, McGraw Hill. HETHERINGTON, C., FLIN, R. & MEARNS, K. 2006. Safety in shipping: The human element. Journal of Safety Research, 37, 401 – 411. HOLLNAGEL, E. 1998. Cognitive Reliability and Error Analysis Method CREAM, Oxford, Elsevier. HOLLNAGEL, E. 2004. Barriers and Accident Prevention, Aldershot, Ashgate. HOLLNAGEL, E. 2008. The changing nature of the risks. Ergonomics Australia Journal, 22, 33 – 46. HOLLNAGEL, E. 2009. The ETTO principle: efficiency – thoroughness trade – off: why things that go right sometimes go wrong, Farnham, Ashgate. HOLLNAGEL, E. & SPEZIALI, J. 2008. Study on developments in accident investigation methods: a survey of the "state – of – the – art". SKI Report 2008:50. ISSN 1104- 1374. IMO 1973/1978. MARPOL. London: IMO. IMO 1974. SOLAS - Safety of Life at Sea, London, IMO. IMO 1997a. Resolution A.849(20) Code for the Investigation of Marine Casualties and Incidents. London: IMO.

154

IMO 1997b. Resolution A.850 (20) Human element vision, principles and goals for the organisation. London: IMO. Online at: http://www.imo.org/KnowledgeCentre/IndexofIMOResolutions/Pages/Assembly- %28A%29.aspx. IMO 1997c. Resolution A.865(20) Minimum Training Requirements for Personnel Nominated to Assist Passengers in Emergency Situations on Passenger Ships. London: IMO. IMO 2000a. MSC 72. London: IMO. IMO 2000b. Resolution A.884(21) adopted on 25 November 1999. Amendments to the Code for the Investigation of Marine Casualties and Incidents (Resolution A.849 (20)). London: IMO. IMO 2002. International Safety Management. IMO - International Maritime Organization. IMO 2006. MSC 82. London: IMO. IMO 2008. MSC-MEPC.3/Circ.2 13 June 2008 Casualty Related Matters; Code of the International Standards and Recommended Practices for a Safety Investigation into a Marine Casualty or Marine Incident. London: IMO. IMO 2010a. Casualty Statistics and Investigations - Study on human and organisational factors by WMU. Sub-committee on flag state implementation, 19th session, agenda item 5. London: IMO. IMO 2010b. MSC.1/Circ. 1369 22 June 2010 Interim Explanatory Notes for the Assessment of Passenger Ship Systems' Capabilities after a Fire or Flooding Casualty. London: IMO. IMO 2012. MSC 91. London: IMO. IMO 2013a. MSC-MEPC.3/Circ.4 28 Aug 2013; Casualty Related Matters; Reports on Marine Casualties and Incidents; Revised Harmonised Reporting Procedures – Reports Required under Solas Regulations I/21 And XI-1/6, and Marpol, Articles 8 and 12. London: IMO. IMO 2013b. MSC 92. London: IMO. IMO 2013c. MSC.1/Circ.1446/Rev.2 8 August 2013; Recommended Interim Measures for Passenger Ship Companies to Enhance the Safety of Passenger Ships. London: IMO. IMO 2014a. Resolution A.1075(28) Adopted on 4 Dec 2013 Guidelines to Assist Investigators in the Implementation of the Casualty Investigation Code (Resolution MSC.255(84)). London: IMO. IMO 2014b. World Maritime Day. London: IMO. Online at: http://www.imo.org/About/Events/WorldMaritimeDay/Pages/WMD.aspx. Accessed on Apr 20 2014. KATSAKIORI, P., SAKELLAROPOULOS, G. & MANATAKIS, E. 2009. Towards an evaluation of accident investigation methods in terms of their alignment with the accident causation models. Safety Science, 47, 1007-1015. KIRWAN, B. 1994. A Guide to Practical Human Reliability Assessment, London, Taylor & Francis. KOROLIJA, N. & LUNDBERG, J. 2010. Speaking of human factors: emergent meanings in interviews with professional accident investgators. Safety Science, 48, 157-165. KRISTIANSEN, S. An approach to systematic learning from accidents. The Institute of Marine Engineers Conference Proceedings on Management and Operation of Ships – Practical Techniques for Today and Tomorrow (IMAS 95). Volume 107, No. The Institute of Marine Engineers, 1995. LE-COZE, J.-C. 2013. New models for new times. An anti-dualist move. Safety Science, 59, 200-218.

155

LEHTO, M. & SALVENDY, G. 1991. Models of accident causation and the application: review and reappraisal. Journal of Engineering and Technology Management, 8, 173-205. LEVESON, N. G. 2004. A new accident model for engineering safer systems. Science, 42, 237 – 270. LIEBL A HALLER J, JÖDICKE B, BAUMGARTNER H, SCHLITTMEIER S, HELLBRÜCK J. 2011. Combined effects of acoustic and visual distraction on cognitive performance and well-being. Appl. Ergonomics 43 (2): 424-434 MAIB 2011. RMS Queen Mary 2: report on the investigation of the catastrophic failure of a capacitor in the aft harmonic filter room on-board. . London: MAIB. Online at: http://www.maib.gov.uk/publications/investigation_reports/2011/qm2.cfm. MANUEL, M. E. 2012. Maritime Risk and Organisational Learning, Farnham, Ashgate. MSI 2013. Safety investigation into the fire on-board the Maltese registered passenger ship Azamar Quest during a passage between Manila and Sandakan on 30 Mar 2012. Malta: MSI. Online at: http%3A%2F%2Fmti.gov.mt%2Fen%2FDocument%2520Repository%2FMSIU%2 520Documents%2FInvestigations%25202012%2FMV%2520Azamara%2520Quest_ Final%2520Safety%2520Investigtion%2520Report.pdf&ei=VkEmVKGvFeq6ygP7 m4HoAQ&usg=AFQjCNG7zKXdI6WnxTTWHuwgPqMzzns4Kw. PERROW, C. 1984. Normal Accidents: Living with High – Risk Technologies, New York, Basic Books. QURESHI, Z. H. 2007. A Review of Accident Modelling Approaches for Complex Socio – Technical Systems. In: CANT, T. (ed.) Australian Computer Society – 12th Australian Workshop on Safety-Related Programmable Systems (SCS'07), Adelaide. Conferences in Research and Practice in Information Technology, Vol 86. Tony Cant Ed. QURESHI, Z. H. 2008. A review of accident modelling approaches for complex critical sociotechnical systems. Edinburgh: DSTO Defence Science and Technology Organisation. RASMUSSEN, J. 1997. Risk management in a dynamic society: a modelling problem. Safety Science, 27, 183-213. REASON, J. 1990. Human Error, Cambridge, Cambridge University Press. REASON, J. 1997a. Managing the risk of organizational accidents, Aldershot, Ashgate. REASON, J. 1998. Achieving a safe culture: theory and practice. Work & stress, 12, 293- 306. REASON, J. 2008. The human contribution: unsafe acts, accidents, and heroic recoveries, Farnham, Ashgate. REASON, J. T. 1997b. Managing the risks of organisational accidents, Aldershot, Ashgate. REASON, J. T. 2000. Human error: models and management. BMJ, 320, 768 – 770. SCHRÖDER-HINRICHS, J.-U. 2013. Review of human factor implications of the cost Concordia accident. Presentation made to the Finnish Seamen's Mission, Helsinki, 07 November 2013. SCHRÖDER-HINRICHS; J.-U., 2014: SEMOMAP Model, MaRiSa, WMU, Malmö SCHRÖDER-HINRICHS, J.-U., BALDAUF, M. & GHIRXI, K. T. 2011. Accident investigation reporting deficiencies related to organisational factors in machinery space fires and explosions. Accid Anal Prev, 43, 1187-1196. SCHRÖDER-HINRICHS, J.-U. & HOLLNAGEL, E. 2012. From Titanic to Costa Concordia – a century of lessons not learned. WMU Journal of Maritime Affairs, 11, 151-167.

156

SCHRÖDER-HINRICHS, J.-U., HOLLNAGEL, E. & BALDAUF, M. 2012. From Titanic to Costa Concordia – a century of lessons not learned. WMU Journal of Maritime Affairs, DOI 10.1007/s13437-012-0032-3. Online at: http://link.springer.com/article/10.1007%2Fs13437-012-0032-3. SCHRÖDER-HINRICHS, J.-U., HOLLNAGEL, E., BALDAUF, M., HOFMANN, S. & KATARIA, A. 2013. Maritime human factors and IMO policy. Maritime Policy & Management, 40, 243-260. SCHRÖDER-HINRICHS, J. U., BALDAUF, M. & GHIRXI, K. T. 2010. Accident Investigation Reporting Deficiencies Related to Organisational Factors in Machinery Space Fires and Explosions. Accident Analysis and Prevention, 43, 1187-1196. SCHRÖDER-HINRICHS, J. U., HOLLNAGEL, E., BALDAUF, M., HOFMANN, S. & KATARIA, A. 2013. Maritime human factors and IMO policy. Maritime Policy & Management, 40, 243-260. SCHRÖDER, J.-U. 2004. SEMOMAP - SEquential MOdel of the Maritime Accident Process. In: JOHNSON, C. W. & PALANQUE, P. (eds.) Human Error, Safety and Systems Development - IFIP 18th World Computer Congress TC13/WC13.5 7th Working Conference on Human Error, Safety and Systems Development 22-27 August 2004, Toulouse, France. Springer. SCHRÖDER, J.-U. & HAHNE, J. 2003. Maritime casualty analysis – an adequate basis for simulation during maritime education and training? MARSIM' 03 International Conference on Marine Simulation and Ship Manoeuvrability, Kanazawa, Japan. The society of Naval architects of Japan, Japan Institute of Navigation, International Marine Simulator Forum. Volume I, RA-24. SCHRÖDER, J. U. 2003. The Human Element (HE) in Marine Casualties - Are we prepared to address the real issues? in Risk and Safety Management in Industry, Logistics, Transport and Military Service: New Solutions for the 21st Century, 48-53. Talinn: Technical University. SHORROCK, S. T. & KIRWAN, B. 2002. Development and application of a human error identification tool for a traffic control. Applied Ergonomics, 33, 319 – 336. SKLET, S. 2004. Comparison of some selected methods for accident investigation. Journal of Hazardous Materials, 111, 29-37. TARELKO, W. 2012. Origins of ship safety requirements formulated by International Maritime Organisation. Procedia Engineering, 45, 847-856. UNDERWOOD, P. & WATERSON, P. 2013. Accident Analysis Mmodels and Methods: Guidance for Safety Professionals. Loughborough University. USCG 2013. Report of investigation into the fire on board the Carnival Splendor which occurred in the Pacific Ocean off the coast of Mexico on November 8, 2010, which resulted in complete loss of power. Washington: USCG. Online at: http://www.google.se/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CDk QFjAD&url=http%3A%2F%2Fwww.cruisejunkie.com%2FSplendor.pdf&ei=MUQ mVKifJ- G6ygPP6YKgCA&usg=AFQjCNFvVlWI7YhqtYPa0E9E5AZjHSWYmA&bvm=bv .76247554,d.bGQ. WIEGMANN, D. A. & SHAPPELL, S. A. 2003. A Human Error Approach to Aviation Accident Analysis: The Human Factors Analysis and Classification System, Aldershot, Ashgate.

157